Linux Kernel Vulnerability Affecting PCI Device Refcount Management

CVE-2022-50337

What is CVE-2022-50337?

A vulnerability exists in the Linux kernel related to improper management of PCI device reference counts. Specifically, the function get_function_0() fails to correctly handle the reference counting, which can lead to a refcount leak. This issue requires the use of pci_dev_put() after obtaining the device reference to prevent resource leaks and ensure stable memory management. Adequate comments have been added in the code to guide developers on proper usage and cleanup practices.

References