CVE-2022-49926

published 2025-05-01

CVE-2022-49926: In the Linux kernel, the following vulnerability has been resolved: net: dsa: Fix possible memory leaks in dsa_loop_init() kmemleak reported memory leaks in…

Priority P4 17 medium 5.5 CVSS 3.1

AV L AC L PR L UI N S U C N I N A H

In the Linux kernel, the following vulnerability has been resolved:

net: dsa: Fix possible memory leaks in dsa_loop_init()

kmemleak reported memory leaks in dsa_loop_init():

kmemleak: 12 new suspected memory leaks

unreferenced object 0xffff8880138ce000 (size 2048):
comm "modprobe", pid 390, jiffies 4295040478 (age 238.976s)
backtrace:
[] kmalloc_trace+0x26/0x60
[] phy_device_create+0x5d/0x970
[] get_phy_device+0xf3/0x2b0
[] __fixed_phy_register.part.0+0x92/0x4e0
[] fixed_phy_register+0x84/0xb0
[] dsa_loop_init+0xa9/0x116 [dsa_loop]
...

There are two reasons for memleak in dsa_loop_init().

First, fixed_phy_register() create and register phy_device:

fixed_phy_register()
get_phy_device()
phy_device_create() # freed by phy_device_free()
phy_device_register() # freed by phy_device_remove()

But fixed_phy_unregister() only calls phy_device_remove().
So the memory allocated in phy_device_create() is leaked.

Second, when mdio_driver_register() fail in dsa_loop_init(),
it just returns and there is no cleanup for phydevs.

Fix the problems by catching the error of mdio_driver_register()
in dsa_loop_init(), then calling both fixed_phy_unregister() and
phy_device_free() to release phydevs.
Also add a function for phydevs cleanup to avoid duplacate.

Affected

20 ranges

Vendor	Product	Version range	Fixed in
debian	linux	< linux 6.0.8-1 (bookworm)	linux 6.0.8-1 (bookworm)
linux	linux	—	—
linux	linux	>= 98cd1552ea27e512c7e99e2aa76042a26e4fb25c < 935b4beb724946a37cebf97191592d4879d3a3a3	935b4beb724946a37cebf97191592d4879d3a3a3
linux	linux	>= 98cd1552ea27e512c7e99e2aa76042a26e4fb25c < d593e1ede655b74c42e4e4fe285ea64aee96fb5c	d593e1ede655b74c42e4e4fe285ea64aee96fb5c
linux	linux	>= 98cd1552ea27e512c7e99e2aa76042a26e4fb25c < bbc5d7b46a729bfcbb5544f6612b7a67dd4f4d6f	bbc5d7b46a729bfcbb5544f6612b7a67dd4f4d6f
linux	linux	>= 98cd1552ea27e512c7e99e2aa76042a26e4fb25c < 37a098fc9b42bd7fce66764866aa514639667b6e	37a098fc9b42bd7fce66764866aa514639667b6e
linux	linux	>= 98cd1552ea27e512c7e99e2aa76042a26e4fb25c < 9f555b1584fc2d5d16ee3c4d9438e93ac7c502c7	9f555b1584fc2d5d16ee3c4d9438e93ac7c502c7
linux	linux	>= 98cd1552ea27e512c7e99e2aa76042a26e4fb25c < 4d2024b138d9f7b02ae13ee997fd3a71e9e46254	4d2024b138d9f7b02ae13ee997fd3a71e9e46254
linux	linux	>= 98cd1552ea27e512c7e99e2aa76042a26e4fb25c < 633efc8b3dc96f56f5a57f2a49764853a2fa3f50	633efc8b3dc96f56f5a57f2a49764853a2fa3f50
linux	linux_kernel	—	—
linux	linux_kernel	>= 0 < 5.10.158-1	5.10.158-1
linux	linux_kernel	>= 0 < 6.0.8-1	6.0.8-1
linux	linux_kernel	>= 0 < 6.0.8-1	6.0.8-1
linux	linux_kernel	>= 0 < 6.0.8-1	6.0.8-1
linux	linux_kernel	>= 4.12 < 4.14.299	4.14.299
linux	linux_kernel	>= 4.15 < 4.19.265	4.19.265
linux	linux_kernel	>= 4.20 < 5.4.224	5.4.224
linux	linux_kernel	>= 5.11 < 5.15.78	5.15.78
linux	linux_kernel	>= 5.16 < 6.0.8	6.0.8
linux	linux_kernel	>= 5.5 < 5.10.154	5.10.154

CVSS provenance

nvd v3.1 5.5 MEDIUM CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

osv 5.5 MEDIUM

vendor_debian 5.5 MEDIUM

vendor_redhat 5.5 MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-401