CVE-2022-49982

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-49982
In the Linux kernel, the following vulnerability has been resolved: media: pvrusb2: fix memory leak in pvr_probe The error handling code in pvr2_hdw_create forgets to unregister the v4l2 device. When pvr2_hdw_create returns back to pvr2_context_create, it calls pvr2_context_destroy to destroy context, but mp->hdw is NULL, which leads to that pvr2_hdw_destroy directly returns. Fix this by adding v4l2_device_unregister to decrease the refcount of usb interface.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/2fe46195d2f0d5d09ea65433aefe47a4d0d0ff4d Patch
https://git.kernel.org/stable/c/466b67c0543b2ae67814d053f6e29b39be6b33bb Patch
https://git.kernel.org/stable/c/491762b3250fb06a0c97b5198656ea48359eaeed Patch
https://git.kernel.org/stable/c/945a9a8e448b65bec055d37eba58f711b39f66f0 Patch
https://git.kernel.org/stable/c/ba7dd8a9686a61a34b3a7b922ce721378d4740d0 Patch
https://git.kernel.org/stable/c/bacb37bdc2a21c8f7fdc83dcc0dea2f4ca1341fb Patch
https://git.kernel.org/stable/c/c02d2a91a85c4c4d05826cd1ea74a9b8d42e4280 Patch
https://git.kernel.org/stable/c/f2f6e67522916f53ad8ccd4dbe68dcf76e9776e5 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

14 Nov 2025, 18:14

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/2fe46195d2f0d5d09ea65433aefe47a4d0d0ff4d - () https://git.kernel.org/stable/c/2fe46195d2f0d5d09ea65433aefe47a4d0d0ff4d - Patch
References () https://git.kernel.org/stable/c/466b67c0543b2ae67814d053f6e29b39be6b33bb - () https://git.kernel.org/stable/c/466b67c0543b2ae67814d053f6e29b39be6b33bb - Patch
References () https://git.kernel.org/stable/c/491762b3250fb06a0c97b5198656ea48359eaeed - () https://git.kernel.org/stable/c/491762b3250fb06a0c97b5198656ea48359eaeed - Patch
References () https://git.kernel.org/stable/c/945a9a8e448b65bec055d37eba58f711b39f66f0 - () https://git.kernel.org/stable/c/945a9a8e448b65bec055d37eba58f711b39f66f0 - Patch
References () https://git.kernel.org/stable/c/ba7dd8a9686a61a34b3a7b922ce721378d4740d0 - () https://git.kernel.org/stable/c/ba7dd8a9686a61a34b3a7b922ce721378d4740d0 - Patch
References () https://git.kernel.org/stable/c/bacb37bdc2a21c8f7fdc83dcc0dea2f4ca1341fb - () https://git.kernel.org/stable/c/bacb37bdc2a21c8f7fdc83dcc0dea2f4ca1341fb - Patch
References () https://git.kernel.org/stable/c/c02d2a91a85c4c4d05826cd1ea74a9b8d42e4280 - () https://git.kernel.org/stable/c/c02d2a91a85c4c4d05826cd1ea74a9b8d42e4280 - Patch
References () https://git.kernel.org/stable/c/f2f6e67522916f53ad8ccd4dbe68dcf76e9776e5 - () https://git.kernel.org/stable/c/f2f6e67522916f53ad8ccd4dbe68dcf76e9776e5 - Patch
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
First Time Linux
Linux linux Kernel
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: media: pvrusb2: se corrige una fuga de memoria en pvr_probe. El código de gestión de errores en pvr2_hdw_create olvida anular el registro del dispositivo v4l2. Cuando pvr2_hdw_create regresa a pvr2_context_create, llama a pvr2_context_destroy para destruir el contexto, pero mp->hdw es NULL, lo que provoca que pvr2_hdw_destroy regrese directamente. Para solucionar esto, agregue v4l2_device_unregister para reducir el recuento de referencias de la interfaz USB.
CWE CWE-401
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

18 Jun 2025, 11:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-06-18 11:15

Updated : 2025-11-14 18:14

NVD link : CVE-2022-49982

Mitre link : CVE-2022-49982

CVE.ORG link : CVE-2022-49982

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-401

Missing Release of Memory after Effective Lifetime