CVE-2022-50760 in Linux
Summary
by MITRE • 12/24/2025
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: Fix PCI device refcount leak in amdgpu_atrm_get_bios()
As comment of pci_get_class() says, it returns a pci_device with its refcount increased and decreased the refcount for the input parameter @from if it is not NULL.
If we break the loop in amdgpu_atrm_get_bios() with 'pdev' not NULL, we need to call pci_dev_put() to decrease the refcount. Add the missing pci_dev_put() to avoid refcount leak.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 04/21/2026
The vulnerability identified as CVE-2022-50760 represents a critical resource management flaw within the Linux kernel's amdgpu driver subsystem. This issue specifically affects the drm/amdgpu component responsible for handling AMD graphics processing units and their associated device management operations. The flaw manifests as a reference count leak in the amdgpu_atrm_get_bios() function, which is part of the kernel's graphics driver infrastructure that manages device communication and firmware retrieval processes.
The technical root cause stems from improper handling of PCI device reference counting within the amdgpu_atrm_get_bios() function. According to the Linux kernel documentation and the pci_get_class() function's comment, this API returns a pci_device structure with its reference count incremented, while simultaneously decrementing the reference count of any input parameter @from if it is not NULL. The vulnerability occurs when the function's loop structure encounters a condition where pdev is not NULL and the loop terminates prematurely without properly releasing the acquired reference count. This creates a memory management inconsistency where the reference counter remains incremented beyond its intended scope.
The operational impact of this vulnerability extends beyond simple resource leakage to potentially compromise system stability and performance over extended periods of operation. When the amdgpu driver processes graphics device initialization or firmware retrieval operations, the accumulated reference count leaks can lead to exhaustion of available PCI device references, ultimately causing driver malfunction or system instability. This type of resource leak directly correlates to CWE-404, which classifies improper resource management as a fundamental security weakness, and aligns with ATT&CK technique T1490, which covers resource exhaustion attacks that can degrade system performance and availability.
The mitigation strategy for CVE-2022-50760 involves implementing the missing pci_dev_put() call in the amdgpu_atrm_get_bios() function to properly decrement the reference count when exiting the loop with a non-NULL pdev value. This correction ensures that every pci_get_class() call's incremented reference is properly balanced by a corresponding pci_dev_put() operation. System administrators should prioritize applying the kernel patch that addresses this vulnerability, particularly in environments where AMD graphics hardware is extensively utilized. The fix represents a standard defensive programming practice that prevents resource management errors and maintains proper device reference accounting throughout the driver's operational lifecycle. Organizations should also consider monitoring for potential system instability or performance degradation that may have occurred prior to patching, as the accumulated reference leaks could have contributed to intermittent driver failures or reduced system responsiveness.