CVE-2022-50868

Vulnerability

Overview

CVE-2022-50868 describes a reference counting flaw in the Linux kernel's hwrng: amd driver. The for_each_pci_dev() macro, which internally uses pci_get_device(), increments the reference count of each PCI device it returns. If a loop iteration breaks while holding a non-NULL pdev (for example, when an error occurs or after successfully finding the desired device), the driver must call pci_dev_put() to decrement the reference count. The AMD hwrng driver omitted this call in both its normal completion path and its error path, leading to a persistent refcount leak [1][2][3][4].

Exploitation & Attack Surface

The vulnerability resides in device driver initialization and teardown code. An attacker would need local access and the ability to trigger the AMD hwrng driver's probe or remove sequence—typically by causing the hardware RNG device to be discovered or by attempting to unload the driver. No special privileges beyond basic system access are required, because the driver is commonly loaded automatically on systems with an AMD chipset that includes a hardware RNG. The bug manifests whenever the driver's loop over PCI devices exits prematurely, whether due to a successful match or an error condition [1][4].

Impact

A successful exploit of this refcount leak results in the PCI device's reference count never reaching zero. Consequently, the kernel will not properly release the device structure, preventing the driver from being unloaded and the PCI device from being safely removed or hot-unplugged. Over time, repeated driver load/unload cycles could exhaust kernel memory or lead to a denial-of-service condition on the system [1][2][3][4].

Mitigation

Status

Patches have been merged into the Linux kernel stable branches (commits visible in references [1] through [4]). System administrators should apply the latest kernel updates from their distribution to close this vulnerability. There is no indication that CVE-2022-50868 is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog [1][2][3][4].