# CVE-2022-50760: CVE-2022-50760

Status: published. Published: 2025-12-24. Updated: 2026-11-10.

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: Fix PCI device refcount leak in amdgpu_atrm_get_bios()

As comment of pci_get_class() says, it returns a pci_device with its
refcount increased and decreased the refcount for the input parameter
@from if it is not NULL.

If we break the loop in amdgpu_atrm_get_bios() with 'pdev' not NULL, we
need to call pci_dev_put() to decrease the refcount. Add the missing
pci_dev_put() to avoid refcount leak.

## Remediation

No remediation reported in collected sources

## Affected products and versions

Not reported in collected sources.

## Severity and prioritization

- CISA KEV: No listing in collected sources

- EPSS: Not available

- SSVC: Not available

- Weaknesses: Not reported

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://git.kernel.org/stable/c/3360125d721c91d697c71201f18f042ff743e936 (416baaa9-dc9f-4396-8d5f-8c081fb06d67)

- https://git.kernel.org/stable/c/6611feef35c0c8c4d297b28a7fc6ab3a2c47eca7 (416baaa9-dc9f-4396-8d5f-8c081fb06d67)

- https://git.kernel.org/stable/c/7c1ddf7c664b5bc91f14b1bdeaa45520ef1760e4 (416baaa9-dc9f-4396-8d5f-8c081fb06d67)

- https://git.kernel.org/stable/c/8f2d2badf8ca5e7e7c30d88840b695c8af7286f3 (416baaa9-dc9f-4396-8d5f-8c081fb06d67)

- https://git.kernel.org/stable/c/981024abf5fe605c94d4f906f65d1b3408d628be (416baaa9-dc9f-4396-8d5f-8c081fb06d67)

- https://git.kernel.org/stable/c/9d4057d0452243917e12eb19f1599c96f2f05b14 (416baaa9-dc9f-4396-8d5f-8c081fb06d67)

- https://git.kernel.org/stable/c/a8b54ad7106c0604c4adc4933138b3557739bce0 (416baaa9-dc9f-4396-8d5f-8c081fb06d67)

- https://git.kernel.org/stable/c/ca54639c7752edf1304d92ff4d0c049d4efc9ba0 (416baaa9-dc9f-4396-8d5f-8c081fb06d67)

- https://git.kernel.org/stable/c/da7c78ea9e62bb65273d3ff19a3866ec205bfe18 (416baaa9-dc9f-4396-8d5f-8c081fb06d67)

## Provenance

- NVD: https://nvd.nist.gov/vuln/detail/CVE-2022-50760; retrieved 2026-11-10; source updated 2026-11-10

Revision: b477d92d578483404713a8f54c19f02fccac74402c03500890db32e285e45a2e

Canonical: https://y2.dev/cve/CVE-2022-50760

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.