CVE-2022-50670

The omap_hsmmc driver in the Linux kernel fails to check the return value of the mmc_add_host() function. According to the CVE description, if mmc_add_host() fails, the memory allocated by mmc_alloc_host() is never freed, and in the remove path mmc_remove_host() is called on a device that was not added, leading to a null-ptr-deref in device_del().

This issue can be triggered when mmc_add_host() encounters an error, such as during resource allocation failures. An attacker with the ability to induce device errors on a system using the OMAP HSMMC driver could potentially cause a denial of service.

The impact includes a memory leak and a kernel crash upon driver removal, resulting in a denial of service. No privilege escalation or data corruption is described.

The fix was applied in the Linux kernel stable branch in commit fb3d596267a9 [1]. The commit adds a return value check for mmc_add_host() and ensures that on failure, the error path properly calls mmc_free_host(). Users should update their kernel to include this patch.