LiveActive security incident?Get immediate response
CVE Record

CVE-2022-50640: mmc: core: Fix kernel panic when remove non-standard SDIO card

In the Linux kernel, the following vulnerability has been resolved: mmc: core: Fix kernel panic when remove non-standard SDIO card SDIO tuple is only allocated for standard SDIO card, especially it causes memory corruption issues when the non-standard SDIO card has removed, which is because the card device's reference counter does not increase for it at sdio_init_func(), but all SDIO card device reference counter gets decreased at sdio_release_func().

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

This Linux kernel issue can cause memory corruption or a kernel panic when a non-standard SDIO card is removed. Business impact is most likely device crash or service interruption on systems that use removable or embedded SDIO hardware. Public sources do not provide CVSS scoring, exploitation evidence, or broad remote attack indications.

Executive priority

Treat as a targeted reliability risk for embedded, mobile, industrial, or appliance-like Linux systems using SDIO. It is not currently supported as an internet-scale emergency. Prioritize affected hardware fleets and maintenance windows for kernel updates after vendor confirmation.

Technical view

The flaw is in Linux MMC/SDIO core handling. SDIO tuple allocation and device reference counting differ for non-standard SDIO cards: initialization does not increment the card device reference counter, while release decrements it for all SDIO devices. Removal can therefore corrupt memory and trigger a kernel panic. Stable kernel commits are referenced as the resolution.

Likely exposure

Exposure appears limited to Linux systems using SDIO/MMC hardware, especially platforms where non-standard SDIO cards can be removed. Servers without SDIO hardware are less likely to be affected. The source bundle lists affected Linux kernel lines including 2.6.36 and several stable branches up to 6.1, but exact downstream vendor impact requires vendor confirmation.

Exploitation context

No active exploitation is indicated; the CVE is not listed as KEV in the provided bundle. The described trigger requires SDIO card removal behavior, suggesting local physical or hardware-adjacent conditions rather than a typical network exploit. Public sources do not describe weaponized exploitation or privilege escalation.

Researcher notes

Evidence is limited to the CVE record description and Linux stable commit references. No CWE, CVSS, exploit status, or downstream distribution advisories are included. Analysis should focus on the MMC/SDIO core reference-counting fix and affected stable branches, while avoiding assumptions about products beyond Linux kernel builds.

Mitigation direction

  • Identify Linux systems with MMC/SDIO hardware or removable SDIO capability.
  • Check your distribution or device vendor advisory for fixed kernel packages.
  • Prioritize kernel updates containing the referenced stable commits.
  • If patching is delayed, reduce access to removable non-standard SDIO hardware where practical.

Validation and detection

  • Inventory running kernel versions across Linux assets.
  • Confirm whether affected systems expose MMC/SDIO hardware paths.
  • Compare vendor kernel builds against the referenced stable fix commits.
  • Monitor logs for kernel panics associated with SDIO card removal.
Prepared
Confidence
medium
Sources
10

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2022-50640 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
9Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux6f51be3d37dff73cf8db771df4169f4c2f1cbf66, 6f51be3d37dff73cf8db771df4169f4c2f1cbf66, 6f51be3d37dff73cf8db771df4169f4c2f1cbf66, 6f51be3d37dff73cf8db771df4169f4c2f1cbf66, 6f51be3d37dff73cf8db771df4169f4c2f1cbf66, 6f51be3d37dff73cf8db771df4169f4c2f1cbf66, 6f51be3d37dff73cf8db771df4169f4c2f1cbf66, 6f51be3d37dff73cf8db771df4169f4c2f1cbf66unaffected
LinuxLinux2.6.36, 0, 4.9.332, 4.14.298, 4.19.264, 5.4.223, 5.10.153, 5.15.77, 6.0.7, 6.1affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.