What’s Vulnerable › Vulnerabilities

CVE-2022-50146: PCI: dwc: Deallocate EPC memory on dw_pcie_ep_init() errors

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-06-18 · updated 2026-06-17
• Weakness: CWE-401

Description

In the Linux kernel, the following vulnerability has been resolved: PCI: dwc: Deallocate EPC memory on dw_pcie_ep_init() errors If dw_pcie_ep_init() fails to perform any action after the EPC memory is initialized and the MSI memory region is allocated, the latter parts won't be undone thus causing a memory leak. Add a cleanup-on-error path to fix these leaks. [bhelgaas: commit log]

Affected products

• Linux kernel: from 4.16 before 5.10.137; from 5.11 before 5.15.61; from 5.16 before 5.18.18; from 5.19 before 5.19.2 — fixed in 5.10.137, 5.15.61, 5.18.18, 5.19.2

How to fix

Upgrade to a fixed version: Linux kernel 5.10.137, 5.15.61, 5.18.18, 5.19.2. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/2d546db5c80c45cac3ccd929550244fd58f4ff58
• https://git.kernel.org/stable/c/3b453f5d06d1f1d6b20a75ea51dc7b53ae78f479
• https://git.kernel.org/stable/c/8161e9626b50892eaedbd8070ecb1586ecedb109
• https://git.kernel.org/stable/c/b03a8f1264ea8c363bec9ef6e37b467f27cb04ea
• https://git.kernel.org/stable/c/e7599a5974d4c64eaae8009c3f2e47b9e3223e07

Get alerted when CVE-2022-50146 or the next vulnerability affects your stack