CVE-2022-50846

What it actually does

Failure to check the return value of mmc_add_host() in the via-sdmmc driver causes mmc_alloc_host() memory to be leaked and allows mmc_remove_host() to be invoked on an unadded device during removal, resulting in a null pointer dereference in device_del().

Why it matters to the business

Systems using the affected MMC controller may experience kernel crashes or resource leaks during device initialization or removal, reducing system stability and availability in embedded or storage-heavy environments.

How an attack unfolds

An attacker with local access triggers repeated load and unload operations of the via-sdmmc driver or related MMC hardware events; the unchecked error path leaves the host structure in an inconsistent state so that the subsequent remove routine dereferences a null pointer and crashes the kernel.

How to fix it

Update to a kernel containing commit 076bcd2c93e16b05c10564e299d6e5d26a766d00 or later; Debian chromium packages should be upgraded to 71.0.3578.80-1 or newer equivalent that incorporates the corrected driver logic.

How to confirm the fix worked

Confirm the presence of the fix commit in the running kernel source tree and verify that mmc_add_host() return values are now checked with an error-handling goto to mmc_free_host() before any remove path executes.

Typical attack path

1. Obtain local code execution or physical access to trigger MMC device events
2. Cause the via-sdmmc driver to call mmc_add_host() which returns an error
3. Trigger driver removal or module unload path
4. mmc_remove_host() executes on the uninitialized device leading to null-ptr-deref crash

How to detect it

Search kernel logs for oops/panic traces referencing mmc_remove_host, device_del, or via-sdmmc around device removal events; review dmesg or journalctl for mmc_add_host error returns that were previously ignored.

What your security team should do

• Apply the listed fixed kernel versions or Debian package updates immediately on all affected systems
• Prioritize patching in environments where MMC/SD card hot-plug or driver reload is common
• Monitor for kernel oops or panic logs containing device_del or mmc_remove_host after the published date