CVE-2022-49787

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-49787
In the Linux kernel, the following vulnerability has been resolved: mmc: sdhci-pci: Fix possible memory leak caused by missing pci_dev_put() pci_get_device() will increase the reference count for the returned pci_dev. We need to use pci_dev_put() to decrease the reference count before amd_probe() returns. There is no problem for the 'smbus_dev == NULL' branch because pci_dev_put() can also handle the NULL input parameter case.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/222cfa0118aa68687ace74aab8fdf77ce8fbd7e6 Patch
https://git.kernel.org/stable/c/27f712cd47d65e14cd52cc32a23d42aeef583d5d Patch
https://git.kernel.org/stable/c/35bca18092685b488003509fef7055aa2d4f2ebc Patch
https://git.kernel.org/stable/c/4423866d31a06a810db22062ed13389416a66b22 Patch
https://git.kernel.org/stable/c/5dbd6378dbf96787d6dbcca44156c511ae085ea3 Patch
https://git.kernel.org/stable/c/7570e5b5419ffd34b6dc45a88c51e113a9a187e3 Patch
https://git.kernel.org/stable/c/a99a547658e5d451f01ed307426286716b6f01bf Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.1:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.1:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.1:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.1:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.1:rc5:*:*:*:*:*:*
History

07 Nov 2025, 19:32

Type Values Removed Values Added
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.1:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.1:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.1:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.1:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.1:rc4:*:*:*:*:*:*
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: mmc: sdhci-pci: Se corrige una posible fuga de memoria causada por la omisión de pci_dev_put(). pci_get_device() aumentará el recuento de referencias para el pci_dev devuelto. Necesitamos usar pci_dev_put() para disminuir el recuento de referencias antes de que amd_probe() regrese. No hay problema para la rama 'smbus_dev == NULL', ya que pci_dev_put() también puede gestionar el caso del parámetro de entrada NULL.
References () https://git.kernel.org/stable/c/222cfa0118aa68687ace74aab8fdf77ce8fbd7e6 - () https://git.kernel.org/stable/c/222cfa0118aa68687ace74aab8fdf77ce8fbd7e6 - Patch
References () https://git.kernel.org/stable/c/27f712cd47d65e14cd52cc32a23d42aeef583d5d - () https://git.kernel.org/stable/c/27f712cd47d65e14cd52cc32a23d42aeef583d5d - Patch
References () https://git.kernel.org/stable/c/35bca18092685b488003509fef7055aa2d4f2ebc - () https://git.kernel.org/stable/c/35bca18092685b488003509fef7055aa2d4f2ebc - Patch
References () https://git.kernel.org/stable/c/4423866d31a06a810db22062ed13389416a66b22 - () https://git.kernel.org/stable/c/4423866d31a06a810db22062ed13389416a66b22 - Patch
References () https://git.kernel.org/stable/c/5dbd6378dbf96787d6dbcca44156c511ae085ea3 - () https://git.kernel.org/stable/c/5dbd6378dbf96787d6dbcca44156c511ae085ea3 - Patch
References () https://git.kernel.org/stable/c/7570e5b5419ffd34b6dc45a88c51e113a9a187e3 - () https://git.kernel.org/stable/c/7570e5b5419ffd34b6dc45a88c51e113a9a187e3 - Patch
References () https://git.kernel.org/stable/c/a99a547658e5d451f01ed307426286716b6f01bf - () https://git.kernel.org/stable/c/a99a547658e5d451f01ed307426286716b6f01bf - Patch
CWE CWE-401
First Time Linux
Linux linux Kernel
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5

01 May 2025, 15:16

Type Values Removed Values Added
New CVE
Information

Published : 2025-05-01 15:16

Updated : 2025-11-07 19:32

NVD link : CVE-2022-49787

Mitre link : CVE-2022-49787

CVE.ORG link : CVE-2022-49787

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-401

Missing Release of Memory after Effective Lifetime