CVE-2022-50858

A flaw was found in the Linux kernel's Alcor Micro MMC card reader driver. When mmc_add_host() fails, its return value is not checked, causing memory allocated by mmc_alloc_host() to leak. Additionally, the remove path may attempt to delete a device that was never added, leading to a kernel crash.

This bug manifests only when mmc_add_host() fails during driver initialization, which is an uncommon error condition. The memory leak and potential crash affect systems with Alcor Micro card readers encountering initialization failures, representing a limited attack surface that requires specific hardware.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent the alcor module from being loaded. See https://access.redhat.com/solutions/41278 for instructions.