CVE-2022-50337

ocxl: fix pci device refcount leak when calling get_function_0()

published September 15, 2025

CVSS
—
EPSS
0%
Percentile
4.7
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

ocxl: fix pci device refcount leak when calling get_function_0()

get_function_0() calls pci_get_domain_bus_and_slot(), as comment

says, it returns a pci device with refcount increment, so after

using it, pci_dev_put() needs be called.

Get the device reference when get_function_0() is not called, so

pci_dev_put() can be called in the error path and callers

unconditionally. And add comment above get_dvsec_vendor0() to tell

callers to call pci_dev_put().

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00159 · 4.7th percentile
Published
2025-09-15T14:49Z
EPSS history
Timeline
  • 15 SEP 14:49Z
    ocxl: fix pci device refcount leak when calling get_function_0()
    cvelistv5