CVE-2022-50858

What it actually does

Ignoring the return value of mmc_add_host() after mmc_alloc_host() causes a memory leak; subsequent removal attempts on an unadded device trigger a kernel crash.

Why it matters to the business

Linux systems using affected MMC controllers may experience unexpected crashes or resource exhaustion during card initialization or removal, leading to downtime and potential data loss on embedded or server hardware.

How an attack unfolds

An attacker with local access or the ability to trigger MMC device probe/remove cycles (via hardware insertion, driver reload, or error injection) forces mmc_add_host() to fail; the missing error handling leaks memory and leaves the device in an inconsistent state that crashes the kernel on cleanup.

How to fix it

Apply the upstream fix present in commit 289c964fe182ce755044a6cd57698072e12ffa6f or later stable kernels that include the return-value check and mmc_free_host() call on error.

How to confirm the fix worked

Inspect the alcor driver source for the mmc_add_host() error check and mmc_free_host() fallback; boot a patched kernel and confirm no crash occurs when mmc_add_host() is forced to fail during probe.

Typical attack path

1. Gain local access or ability to manipulate MMC/SD hardware events
2. Trigger mmc device registration path that calls mmc_alloc_host() followed by mmc_add_host()
3. Induce mmc_add_host() to return an error (resource contention or injected failure)
4. Observe memory leak; later trigger device removal to dereference unadded device
5. Kernel crashes due to invalid state in remove path

How to detect it

Review kernel logs (dmesg, journalctl) for oops/panic entries mentioning mmc_alcor, mmc_add_host failures, or slab leaks around MMC device registration; correlate with hardware insertion events.

What your security team should do

• Prioritize kernel update to a version containing commit 289c964fe182ce755044a6cd57698072e12ffa6f on all affected systems
• Monitor for kernel oops or panic logs referencing alcor or mmc_add_host
• Test MMC/SD functionality in staging environments before broad deployment