CVE-2022-49866

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-49866

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

I

n the Linux kernel, the following vulnerability has been resolved: net: wwan: mhi: fix memory leak in mhi_mbim_dellink MHI driver registers network device without setting the needs_free_netdev flag, and does NOT call free_netdev() when unregisters network device, which causes a memory leak. This patch sets needs_free_netdev to true when registers network device, which makes netdev subsystem call free_netdev() automatically after unregister_netdevice().

References
Link Resource
https://git.kernel.org/stable/c/2845bc9070cef0c651987487d84d4813d64675dd Patch
https://git.kernel.org/stable/c/3cd3ffe952f78ec5dadf300cb58d4b38a0c0106d Patch
https://git.kernel.org/stable/c/668205b9c9f94d5ed6ab00cce9a46a654c2b5d16 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.1:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.1:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.1:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.1:rc4:*:*:*:*:*:*
History

07 May 2025, 13:22

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
CWE CWE-401
CPE cpe:2.3:o:linux:linux_kernel:6.1:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.1:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.1:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.1:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
First Time Linux linux Kernel
Linux
References () https://git.kernel.org/stable/c/2845bc9070cef0c651987487d84d4813d64675dd - () https://git.kernel.org/stable/c/2845bc9070cef0c651987487d84d4813d64675dd - Patch
References () https://git.kernel.org/stable/c/3cd3ffe952f78ec5dadf300cb58d4b38a0c0106d - () https://git.kernel.org/stable/c/3cd3ffe952f78ec5dadf300cb58d4b38a0c0106d - Patch
References () https://git.kernel.org/stable/c/668205b9c9f94d5ed6ab00cce9a46a654c2b5d16 - () https://git.kernel.org/stable/c/668205b9c9f94d5ed6ab00cce9a46a654c2b5d16 - Patch

02 May 2025, 13:52

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net: wwan: mhi: se corrige una fuga de memoria en mhi_mbim_dellink. El controlador MHI registra el dispositivo de red sin configurar el indicador needs_free_netdev y NO llama a free_netdev() al cancelar el registro del dispositivo de red, lo que provoca una fuga de memoria. Este parche establece needs_free_netdev como verdadero al registrar el dispositivo de red, lo que hace que el subsistema netdev llame automáticamente a free_netdev() después de unregister_netdevice().

01 May 2025, 15:16

Type Values Removed Values Added
New CVE
Information

Published : 2025-05-01 15:16

Updated : 2025-10-01 16:15

NVD link : CVE-2022-49866

Mitre link : CVE-2022-49866

CVE.ORG link : CVE-2022-49866

JSON object : View

Products Affected

linux

CWE
CWE-401

Missing Release of Memory after Effective Lifetime