Security readout for executives and security teams
Plain-English summary
CVE-2022-50718 is a Linux kernel issue in the AMDGPU driver. A PCI device reference was not released during display-audio suspend or resume handling, creating a reference-count leak. The public record does not provide CVSS severity, exploitation evidence, or business-impact specifics.
Executive priority
Treat as routine kernel maintenance unless AMDGPU-heavy systems show stability problems. There is no sourced evidence of active exploitation or severe impact, but kernel updates should be applied through normal patch cycles.
Technical view
The bug is in drm/amdgpu. pci_get_domain_bus_and_slot() increments a PCI device reference count, but the affected suspend/resume display-audio paths did not call pci_dev_put() before returning. Stable kernel commits add the missing release to prevent the leak.
Likely exposure
Exposure is likely limited to Linux systems using the AMDGPU kernel driver, especially systems exercising suspend/resume display-audio paths. The CVE record lists Linux kernel versions and stable fixes, but distro-specific affected package mapping is not provided.
Exploitation context
No active exploitation is reported in the provided sources, and the CVE is not marked as CISA KEV. The sources describe a kernel resource-management flaw, not a remote attack path or public exploit.
Researcher notes
Evidence is limited to the CVE record and Linux stable commits. No CVSS, CWE, exploitability assessment, or distro package data is included. Assess real exposure by mapping kernel builds and AMDGPU usage in your environment.
Mitigation direction
- Update affected Linux kernels using distribution or vendor kernel packages.
- Prioritize systems with AMD GPUs and suspend/resume use cases.
- If self-building kernels, include the referenced stable kernel commits.
- Monitor Linux and distribution advisories for exact fixed package versions.
Validation and detection
- Inventory Linux hosts using the AMDGPU driver.
- Compare running kernel versions against vendor advisories and fixed stable branches.
- Confirm the relevant stable commit is present in custom kernels.
- Review suspend/resume stability signals after patching.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2022-50718 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/3725a8f26bdbc38dfdf545836117f1e069277c91CVE reference
- https://git.kernel.org/stable/c/02105f0b3021ee5853b2fa50853c42f35fc01cfdCVE reference
- https://git.kernel.org/stable/c/f13661b72a61708cecb06562f8acff068a4f31f7CVE reference
- https://git.kernel.org/stable/c/d7352b410471cbebf6350b2990bae82bb0d59a76CVE reference
- https://git.kernel.org/stable/c/b85e285e3d6352b02947fc1b72303673dfacb0aaCVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.