CVE-2022-49949

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-49949
In the Linux kernel, the following vulnerability has been resolved: firmware_loader: Fix memory leak in firmware upload In the case of firmware-upload, an instance of struct fw_upload is allocated in firmware_upload_register(). This data needs to be freed in fw_dev_release(). Create a new fw_upload_free() function in sysfs_upload.c to handle the firmware-upload specific memory frees and incorporate the missing kfree call for the fw_upload structure.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/789bba82f63c3e81dce426ba457fc7905b30ac6e Patch
https://git.kernel.org/stable/c/baf92485d111be828e1ab84a995515b604b938e5 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.0:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.0:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.0:rc3:*:*:*:*:*:*
History

14 Nov 2025, 18:57

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: firmware_loader: Se corrige una fuga de memoria durante la carga de firmware. En la carga de firmware, se asigna una instancia de la estructura fw_upload en firmware_upload_register(). Estos datos deben liberarse en fw_dev_release(). Cree una nueva función fw_upload_free() en sysfs_upload.c para gestionar las liberaciones de memoria específicas de la carga de firmware e incorpore la llamada kfree que falta para la estructura fw_upload.
References () https://git.kernel.org/stable/c/789bba82f63c3e81dce426ba457fc7905b30ac6e - () https://git.kernel.org/stable/c/789bba82f63c3e81dce426ba457fc7905b30ac6e - Patch
References () https://git.kernel.org/stable/c/baf92485d111be828e1ab84a995515b604b938e5 - () https://git.kernel.org/stable/c/baf92485d111be828e1ab84a995515b604b938e5 - Patch
CWE CWE-401
CPE cpe:2.3:o:linux:linux_kernel:6.0:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.0:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.0:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
First Time Linux
Linux linux Kernel

18 Jun 2025, 11:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-06-18 11:15

Updated : 2025-11-14 18:57

NVD link : CVE-2022-49949

Mitre link : CVE-2022-49949

CVE.ORG link : CVE-2022-49949

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-401

Missing Release of Memory after Effective Lifetime