CVE-2022-50886

What it actually does

Failure to check the return value of mmc_add_host() after mmc_alloc_host() causes the allocated host structure to be leaked; on the remove path the code attempts to delete a device that was never added, resulting in a kernel crash.

Why it matters to the business

Linux systems using the affected Toshiba SD host controller driver may leak kernel memory and suffer sudden crashes when the driver is removed, leading to unplanned downtime and potential data loss in storage operations.

How an attack unfolds

An attacker with the ability to load and unload the toshsd driver (local or via crafted hardware insertion/removal) can trigger the unchecked error path, exhausting memory and forcing a crash on unload; no remote unauthenticated exploitation is described.

How to fix it

Update the Linux kernel to a version containing the fix that properly checks mmc_add_host() return value, calls mmc_free_host() on error, and ensures free_irq() is invoked; no langchain-community package is involved.

How to confirm the fix worked

Confirm the patched kernel source contains the return-value check and error-path calls to mmc_free_host() and free_irq(); verify the driver no longer leaks the host structure on mmc_add_host() failure.

Typical attack path

1. Obtain local access or physical access to insert/remove SD hardware that binds the toshsd driver
2. Trigger mmc_add_host() failure condition
3. Unload or remove the driver to execute the buggy remove path
4. Observe memory leak followed by kernel panic

How to detect it

Search kernel logs and dmesg for messages indicating mmc_add_host() failure followed by remove-path warnings; look for kernel oops or panic traces referencing toshsd or mmc_free_host.

• mmc_add_host.*error
• toshsd.*remove
• mmc_free_host
• kernel panic.*mmc

What your security team should do

• Apply the upstream kernel fix immediately on any system exposing the toshsd driver
• Reboot affected hosts after patching to load the corrected module
• Monitor kernel logs for mmc_add_host() failures or toshsd-related oops until patched