LiveActive security incident?Get immediate response
CVE Record

CVE-2022-50653: mmc: atmel-mci: fix return value check of mmc_add_host()

In the Linux kernel, the following vulnerability has been resolved: mmc: atmel-mci: fix return value check of mmc_add_host() mmc_add_host() may return error, if we ignore its return value, it will lead two issues: 1. The memory that allocated in mmc_alloc_host() is leaked. 2. In the remove() path, mmc_remove_host() will be called to delete device, but it's not added yet, it will lead a kernel crash because of null-ptr-deref in device_del(). So fix this by checking the return value and calling mmc_free_host() in the error path.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2022-50653 is a Linux kernel driver flaw in the Atmel MMC interface. If host registration fails, the driver may leak memory and later crash the kernel during removal. Business impact is mainly availability risk on systems using this hardware path. There is no cited evidence of active exploitation or a published CVSS score.

Executive priority

Treat as a targeted availability issue, not a broad internet-facing emergency. Prioritize patch verification for embedded Linux products and appliances using Atmel MMC hardware. Defer broad enterprise escalation unless asset inventory shows affected drivers in production.

Technical view

The atmel-mci driver did not check mmc_add_host() return status. If mmc_add_host() failed after mmc_alloc_host(), cleanup was incomplete and remove() could call mmc_remove_host() for a host not actually added, causing a null pointer dereference in device_del(). Stable kernel commits add error handling and mmc_free_host() cleanup.

Likely exposure

Exposure appears limited to Linux systems with the Atmel MCI/MMC driver present and relevant hardware or device-tree configuration. General-purpose servers are less likely exposed unless they use this driver. The source bundle lists Linux kernel versions as affected but does not provide distribution-specific package names.

Exploitation context

The provided sources describe a failure-path kernel crash, not remote code execution. No KEV listing is present, and no cited source states active exploitation. Practical triggering likely depends on driver initialization or hardware-related error conditions, but the sources do not define an attacker-controlled path.

Researcher notes

Evidence is limited to the CVE record and Linux stable commit references. Severity, CVSS, CWE, and exploitation status are not provided. The affected-version data in the bundle is broad and should be reconciled against kernel stable trees and downstream vendor backports.

Mitigation direction

  • Update to a Linux kernel or vendor package containing the referenced stable fixes.
  • Check Linux distribution or device vendor advisories for backported patches.
  • Prioritize embedded or appliance systems using Atmel MCI/MMC hardware.
  • If updates are unavailable, ask the vendor for supported mitigation guidance.

Validation and detection

  • Inventory Linux systems for use of the atmel-mci driver.
  • Compare running kernel versions against vendor-fixed builds or referenced stable commits.
  • Review boot and kernel logs for atmel-mci initialization or removal errors.
  • Confirm patched source checks mmc_add_host() return value and frees host on error.
Prepared
Confidence
medium
Sources
9

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2022-50653 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
8Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux7d2be0749a59096a334c94dc48f43294193cb8ed, 7d2be0749a59096a334c94dc48f43294193cb8ed, 7d2be0749a59096a334c94dc48f43294193cb8ed, 7d2be0749a59096a334c94dc48f43294193cb8ed, 7d2be0749a59096a334c94dc48f43294193cb8ed, 7d2be0749a59096a334c94dc48f43294193cb8ed, 7d2be0749a59096a334c94dc48f43294193cb8edunaffected
LinuxLinux2.6.27, 0, 4.19.270, 5.4.229, 5.10.163, 5.15.86, 6.0.16, 6.1.2, 6.2affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.