CVE-2022-50520

A reference leak flaw was found in the Linux kernel's Radeon graphics driver in the BIOS retrieval logic. A local user on systems with AMD Radeon graphics hardware can trigger this issue when the driver searches for ACPI firmware tables and exits the search loop with an acquired PCI device reference that is never released. This results in a permanent reference leak preventing proper device cleanup and leading to resource exhaustion or denial of service.

The radeon_atrm_get_bios function uses pci_get_class to iterate through PCI devices searching for compatible ACPI firmware tables. The pci_get_class function returns a device pointer with an incremented reference count and decrements the reference for the previous device. When the loop breaks with a non-NULL pdev (having found a suitable device), the code fails to call pci_dev_put to decrement the reference count. This violates PCI device reference counting rules and prevents the device from being properly cleaned up even when the driver is unloaded.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent the radeon module from being loaded. See https://access.redhat.com/solutions/41278 for instructions on blacklisting kernel modules.