CVE-2022-50868 hwrng: amd - Fix PCI device refcount leak
A missing reference count decrement in the AMD hardware random number generator driver can lead to resource leaks and potential denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Not stated
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-50868?
CVE-2022-50868 is a memory corruption vulnerability in Linux, published on 30 Dec 2025.
Official description
In the Linux kernel, the following vulnerability has been resolved:
hwrng: amd - Fix PCI device refcount leak
for_each_pci_dev() is implemented by pci_get_device(). The comment of pci_get_device() says that it will increase the reference count for the returned pci_dev and also decrease the reference count for the input pci_dev @from if it is not NULL.
If we break for_each_pci_dev() loop with pdev not NULL, we need to call pci_dev_put() to decrease the reference count. Add the missing pci_dev_put() for the normal and error path.
Which versions are affected by CVE-2022-50868?
How do I fix CVE-2022-50868?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2022-50868 being exploited?
There is no known exploitation of CVE-2022-50868 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2022-50868, GHSA-c92v-6x7x-f5fw, UBUNTU-CVE-2022-50868.