CVE-2022-50304 mtd: core: fix possible resource leak in init_mtd()
A resource leak in the Linux kernel MTD core prevents reloading the module, causing a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-50304?
CVE-2022-50304 is a medium-severity denial of service vulnerability in Linux kernel, published on 15 Sep 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
mtd: core: fix possible resource leak in init_mtd()
I got the error report while inject fault in init_mtd():
sysfs: cannot create duplicate filename '/devices/virtual/bdi/mtd-0' Call Trace: <TASK> dump_stack_lvl+0x67/0x83 sysfs_warn_dup+0x60/0x70 sysfs_create_dir_ns+0x109/0x120 kobject_add_internal+0xce/0x2f0 kobject_add+0x98/0x110 device_add+0x179/0xc00 device_create_groups_vargs+0xf4/0x100 device_create+0x7b/0xb0 bdi_register_va.part.13+0x58/0x2d0 bdi_register+0x9b/0xb0 init_mtd+0x62/0x171 [mtd] do_one_initcall+0x6c/0x3c0 do_init_module+0x58/0x222 load_module+0x268e/0x27d0 __do_sys_finit_module+0xd5/0x140 do_syscall_64+0x37/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd </TASK> kobject_add_internal failed for mtd-0 with -EEXIST, don't try to register things with the same name in the same directory. Error registering mtd class or bdi: -17
If init_mtdchar() fails in init_mtd(), mtd_bdi will not be unregistered, as a result, we can't load the mtd module again, to fix this by calling bdi_unregister(mtd_bdi) after out_procfs label.
Weakness: CWE-401
Which versions are affected by CVE-2022-50304?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2022-50304?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2022-50304 being exploited?
There is no known exploitation of CVE-2022-50304 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-71350, DEBIAN-CVE-2022-50304, GHSA-x78r-fcw5-873j, ROOT-OS-DEBIAN-11-CVE-2022-50304, ROOT-OS-UBUNTU-2204-CVE-2022-50304, UBUNTU-CVE-2022-50304.