CVE-2022-50640

mmc: core: Fix kernel panic when remove non-standard SDIO card

State: Published
Severity: Not scored
Published: Dec 9, 2025
Updated: May 11, 2026
Reserved: Dec 8, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

mmc: core: Fix kernel panic when remove non-standard SDIO card

SDIO tuple is only allocated for standard SDIO card, especially it causes memory corruption issues when the non-standard SDIO card has removed, which is because the card device's reference counter does not increase for it at sdio_init_func(), but all SDIO card device reference counter gets decreased at sdio_release_func().

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	6f51be3d37dff73cf8db771df4169f4c2f1cbf66 to before b8b2965932e702b21e335ff30e1bb550f5a23b6fAffected 6f51be3d37dff73cf8db771df4169f4c2f1cbf66 to before b3275dde570b6420106a715bb58a0af041b94d95Affected 6f51be3d37dff73cf8db771df4169f4c2f1cbf66 to before 1fb79478695d92bab1c120ad3dad05252b02a29dAffected 6f51be3d37dff73cf8db771df4169f4c2f1cbf66 to before 7a09c64b7da0abdec3919812e3d93ecc44069ed0Affected 6f51be3d37dff73cf8db771df4169f4c2f1cbf66 to before 8bf037279b5869ae9331c42bb1527d2680ebba96Affected 6f51be3d37dff73cf8db771df4169f4c2f1cbf66 to before 1e8cd93ae536581562bab4e1d8c5315bbc2548bfAffected 6f51be3d37dff73cf8db771df4169f4c2f1cbf66 to before 66d461a92f32b6995b630625d350259b6b1f961bAffected 6f51be3d37dff73cf8db771df4169f4c2f1cbf66 to before 9972e6b404884adae9eec7463e30d9b3c9a70b18Affected
LinuxLinux	2.6.36Affected before 2.6.36Not affected 4.9.332 through 4.9.Not affected 4.14.298 through 4.14.Not affected 4.19.264 through 4.19.Not affected 5.4.223 through 5.4.Not affected 5.10.153 through 5.10.Not affected 5.15.77 through 5.15.Not affected 6.0.7 through 6.0.*Not affected 6.1 and laterNot affected

Product

Versions

LinuxLinux

6f51be3d37dff73cf8db771df4169f4c2f1cbf66 to before b8b2965932e702b21e335ff30e1bb550f5a23b6fAffected
6f51be3d37dff73cf8db771df4169f4c2f1cbf66 to before b3275dde570b6420106a715bb58a0af041b94d95Affected
6f51be3d37dff73cf8db771df4169f4c2f1cbf66 to before 1fb79478695d92bab1c120ad3dad05252b02a29dAffected
6f51be3d37dff73cf8db771df4169f4c2f1cbf66 to before 7a09c64b7da0abdec3919812e3d93ecc44069ed0Affected
6f51be3d37dff73cf8db771df4169f4c2f1cbf66 to before 8bf037279b5869ae9331c42bb1527d2680ebba96Affected
6f51be3d37dff73cf8db771df4169f4c2f1cbf66 to before 1e8cd93ae536581562bab4e1d8c5315bbc2548bfAffected
6f51be3d37dff73cf8db771df4169f4c2f1cbf66 to before 66d461a92f32b6995b630625d350259b6b1f961bAffected
6f51be3d37dff73cf8db771df4169f4c2f1cbf66 to before 9972e6b404884adae9eec7463e30d9b3c9a70b18Affected

LinuxLinux

2.6.36Affected
before 2.6.36Not affected
4.9.332 through 4.9.*Not affected
4.14.298 through 4.14.*Not affected
4.19.264 through 4.19.*Not affected
5.4.223 through 5.4.*Not affected
5.10.153 through 5.10.*Not affected
5.15.77 through 5.15.*Not affected
6.0.7 through 6.0.*Not affected
6.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.