LiveActive security incident?Get immediate response
CVE Record

CVE-2022-50886: mmc: toshsd: fix return value check of mmc_add_host()

In the Linux kernel, the following vulnerability has been resolved: mmc: toshsd: fix return value check of mmc_add_host() mmc_add_host() may return error, if we ignore its return value, the memory that allocated in mmc_alloc_host() will be leaked and it will lead a kernel crash because of deleting not added device in the remove path. So fix this by checking the return value and goto error path which will call mmc_free_host(), besides, free_irq() also needs be called.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2022-50886 is a Linux kernel reliability flaw in the MMC Toshiba SD host driver path. If adding the host fails, the kernel may leak memory and later crash during device removal. The sources provide no CVSS score and no evidence of active exploitation.

Executive priority

Treat as a targeted reliability patch, not an emergency based on current evidence. Prioritize normal kernel maintenance, with faster action for systems dependent on affected MMC hardware or where kernel crashes would disrupt critical operations.

Technical view

The toshsd MMC driver ignored the return value from mmc_add_host(). On failure, resources allocated by mmc_alloc_host() were not freed, and remove handling could attempt to delete a device that was never added. Stable fixes add error handling, call mmc_free_host(), and ensure free_irq() is called.

Likely exposure

Exposure appears limited to Linux systems with affected kernel versions and the relevant MMC toshsd driver path. The source lists Linux kernel versions from 3.19 through 6.2 as affected, with stable commit references for fixes.

Exploitation context

No cited source states active exploitation, public weaponization, or remote exploitability. The documented impact is kernel crash risk after an mmc_add_host() failure and later device removal. KEV status is false in the supplied data.

Researcher notes

The record lacks CVSS, CWE, and detailed attack prerequisites. Analysis should focus on code reachability for the toshsd driver, whether mmc_add_host() failure is attacker-influenceable, and whether downstream kernels have backported the listed stable commits.

Mitigation direction

  • Update affected Linux kernels using distribution-approved packages or kernels containing the referenced stable fixes.
  • Check vendor or distribution advisories for backported fixes before relying on upstream version numbers.
  • Prioritize systems using MMC/Toshiba SD host hardware or configurations first.

Validation and detection

  • Inventory Linux kernel versions across affected assets.
  • Determine whether the toshsd MMC driver is present or enabled on those systems.
  • Compare installed kernel changelogs against the referenced stable commits.
  • Confirm vulnerability scanner results with vendor package advisory status.
Prepared
Confidence
medium
Sources
11

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2022-50886 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
10Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxa5eb8bbd66ccf9f169419f9652544aec771b7c57, a5eb8bbd66ccf9f169419f9652544aec771b7c57, a5eb8bbd66ccf9f169419f9652544aec771b7c57, a5eb8bbd66ccf9f169419f9652544aec771b7c57, a5eb8bbd66ccf9f169419f9652544aec771b7c57, a5eb8bbd66ccf9f169419f9652544aec771b7c57, a5eb8bbd66ccf9f169419f9652544aec771b7c57, a5eb8bbd66ccf9f169419f9652544aec771b7c57, a5eb8bbd66ccf9f169419f9652544aec771b7c57unaffected
LinuxLinux3.19, 0, 4.9.337, 4.14.303, 4.19.270, 5.4.229, 5.10.163, 5.15.86, 6.0.16, 6.1.2, 6.2affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.