CVE-2022-50659 hwrng: geode - Fix PCI device refcount leak
A missing reference count decrement in the Geode hardware random number generator driver can lead to a memory leak and potential denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Not stated
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-50659?
CVE-2022-50659 is a denial of service vulnerability in Linux, published on 9 Dec 2025.
Official description
In the Linux kernel, the following vulnerability has been resolved:
hwrng: geode - Fix PCI device refcount leak
for_each_pci_dev() is implemented by pci_get_device(). The comment of pci_get_device() says that it will increase the reference count for the returned pci_dev and also decrease the reference count for the input pci_dev @from if it is not NULL.
If we break for_each_pci_dev() loop with pdev not NULL, we need to call pci_dev_put() to decrease the reference count. We add a new struct 'amd_geode_priv' to record pointer of the pci_dev and membase, and then add missing pci_dev_put() for the normal and error path.
Which versions are affected by CVE-2022-50659?
How do I fix CVE-2022-50659?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2022-50659 being exploited?
There is no known exploitation of CVE-2022-50659 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2022-50659, GHSA-q98r-g989-36w3, UBUNTU-CVE-2022-50659.