{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2022-49741", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-03-27T16:39:17.986Z", "datePublished": "2025-03-27T16:42:52.994Z", "dateUpdated": "2026-05-23T15:22:49.418Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-23T15:22:49.418Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: smscufx: fix error handling code in ufx_usb_probe\n\nThe current error handling code in ufx_usb_probe have many unmatching\nissues, e.g., missing ufx_free_usb_list, destroy_modedb label should\nonly include framebuffer_release, fb_dealloc_cmap only matches\nfb_alloc_cmap.\n\nMy local syzkaller reports a memory leak bug:\n\nmemory leak in ufx_usb_probe\n\nBUG: memory leak\nunreferenced object 0xffff88802f879580 (size 128):\n comm \"kworker/0:7\", pid 17416, jiffies 4295067474 (age 46.710s)\n hex dump (first 32 bytes):\n 80 21 7c 2e 80 88 ff ff 18 d0 d0 0c 80 88 ff ff .!|.............\n 00 d0 d0 0c 80 88 ff ff e0 ff ff ff 0f 00 00 00 ................\n backtrace:\n [] kmalloc_trace+0x20/0x90 mm/slab_common.c:1045\n [] kmalloc include/linux/slab.h:553 [inline]\n [] kzalloc include/linux/slab.h:689 [inline]\n [] ufx_alloc_urb_list drivers/video/fbdev/smscufx.c:1873 [inline]\n [] ufx_usb_probe+0x11c/0x15a0 drivers/video/fbdev/smscufx.c:1655\n [] usb_probe_interface+0x177/0x370 drivers/usb/core/driver.c:396\n [] call_driver_probe drivers/base/dd.c:560 [inline]\n [] really_probe+0x12d/0x390 drivers/base/dd.c:639\n [] __driver_probe_device+0xbf/0x140 drivers/base/dd.c:778\n [] driver_probe_device+0x2a/0x120 drivers/base/dd.c:808\n [] __device_attach_driver+0xf7/0x150 drivers/base/dd.c:936\n [] bus_for_each_drv+0xb7/0x100 drivers/base/bus.c:427\n [] __device_attach+0x105/0x2d0 drivers/base/dd.c:1008\n [] bus_probe_device+0xc6/0xe0 drivers/base/bus.c:487\n [] device_add+0x642/0xdc0 drivers/base/core.c:3517\n [] usb_set_configuration+0x8ef/0xb80 drivers/usb/core/message.c:2170\n [] usb_generic_driver_probe+0x8c/0xc0 drivers/usb/core/generic.c:238\n [] usb_probe_device+0x5c/0x140 drivers/usb/core/driver.c:293\n [] call_driver_probe drivers/base/dd.c:560 [inline]\n [] really_probe+0x12d/0x390 drivers/base/dd.c:639\n [] __driver_probe_device+0xbf/0x140 drivers/base/dd.c:778\n\nFix this bug by rewriting the error handling code in ufx_usb_probe." } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/video/fbdev/smscufx.c" ], "versions": [ { "version": "5385af2f89bc352fb70753ab41b2bb036190141f", "lessThan": "3b3d3127f5b4291ae4caaf50f7b66089ad600480", "status": "affected", "versionType": "git" }, { "version": "d9ddfeb01fb95ffbbc7031d46a5ee2a5e45cbb86", "lessThan": "3931014367ef31d26af65386a4ca496f50f0cfdf", "status": "affected", "versionType": "git" }, { "version": "cc6a7249842fceda7574ceb63275a2d5e99d2862", "lessThan": "64fa364ad3245508d393e16ed4886f92d7eb423c", "status": "affected", "versionType": "git" }, { "version": "cc67482c9e5f2c80d62f623bcc347c29f9f648e1", "lessThan": "1b4c08844628dfc8d72d3f51b657f2a5e63b7b4b", "status": "affected", "versionType": "git" }, { "version": "cc67482c9e5f2c80d62f623bcc347c29f9f648e1", "lessThan": "b76449ee75e21acfe9fa4c653d8598f191ed7d68", "status": "affected", "versionType": "git" }, { "version": "6f2075ea883e5d7730d0c9ebb1bb8e7a1a7e953f", "status": "affected", "versionType": "git" }, { "version": "3f40852d671072836fb7ae331a1f28a24223c4e8", "status": "affected", "versionType": "git" }, { "version": "70faf9d9b6cc74418716bbf76fe75bd2da10ad4a", "status": "affected", "versionType": "git" }, { "version": "8d924b262f3178a9b17c17d4306a9f426c508bd9", "status": "affected", "versionType": "git" }, { "version": "5.4.223", "lessThan": "5.4.232", "status": "affected", "versionType": "semver" }, { "version": "5.10.153", "lessThan": "5.10.168", "status": "affected", "versionType": "semver" }, { "version": "5.15.77", "lessThan": "5.15.93", "status": "affected", "versionType": "semver" }, { "version": "4.9.332", "lessThan": "4.10", "status": "affected", "versionType": "semver" }, { "version": "4.14.298", "lessThan": "4.15", "status": "affected", "versionType": "semver" }, { "version": "4.19.264", "lessThan": "4.20", "status": "affected", "versionType": "semver" }, { "version": "6.0.7", "lessThan": "6.1", "status": "affected", "versionType": "semver" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/video/fbdev/smscufx.c" ], "versions": [ { "version": "6.1", "status": "affected" }, { "version": "0", "lessThan": "6.1", "status": "unaffected", "versionType": "semver" }, { "version": "5.4.232", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.168", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.93", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.11", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.4.223", "versionEndExcluding": "5.4.232" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10.153", "versionEndExcluding": "5.10.168" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15.77", "versionEndExcluding": "5.15.93" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1", "versionEndExcluding": "6.1.11" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1", "versionEndExcluding": "6.2" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9.332" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.14.298" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19.264" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0.7" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/3b3d3127f5b4291ae4caaf50f7b66089ad600480" }, { "url": "https://git.kernel.org/stable/c/3931014367ef31d26af65386a4ca496f50f0cfdf" }, { "url": "https://git.kernel.org/stable/c/64fa364ad3245508d393e16ed4886f92d7eb423c" }, { "url": "https://git.kernel.org/stable/c/1b4c08844628dfc8d72d3f51b657f2a5e63b7b4b" }, { "url": "https://git.kernel.org/stable/c/b76449ee75e21acfe9fa4c653d8598f191ed7d68" } ], "title": "fbdev: smscufx: fix error handling code in ufx_usb_probe", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "problemTypes": [ { "descriptions": [ { "type": "CWE", "cweId": "CWE-401", "lang": "en", "description": "CWE-401 Missing Release of Memory after Effective Lifetime" } ] } ], "metrics": [ { "cvssV3_1": { "scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE" } }, { "other": { "type": "ssvc", "content": { "timestamp": "2025-10-01T17:36:16.841127Z", "id": "CVE-2022-49741", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "version": "2.0.3" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-01T17:36:19.689Z" } } ] } }