cbcvebase.
CVE-2022-49981
published 2025-06-18

CVE-2022-49981: In the Linux kernel, the following vulnerability has been resolved: HID: hidraw: fix memory leak in hidraw_release() Free the buffered reports before deleting…

PriorityP419medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.21%
11.3th percentile
In the Linux kernel, the following vulnerability has been resolved: HID: hidraw: fix memory leak in hidraw_release() Free the buffered reports before deleting the list entry. BUG: memory leak unreferenced object 0xffff88810e72f180 (size 32): comm "softirq", pid 0, jiffies 4294945143 (age 16.080s) hex dump (first 32 bytes): 64 f3 c6 6a d1 88 07 04 00 00 00 00 00 00 00 00 d..j............ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [] kmemdup+0x23/0x50 mm/util.c:128 [] kmemdup include/linux/fortify-string.h:440 [inline] [] hidraw_report_event+0xa2/0x150 drivers/hid/hidraw.c:521 [] hid_report_raw_event+0x27d/0x740 drivers/hid/hid-core.c:1992 [] hid_input_report+0x1ae/0x270 drivers/hid/hid-core.c:2065 [] hid_irq_in+0x1ff/0x250 drivers/hid/usbhid/hid-core.c:284 [] __usb_hcd_giveback_urb+0xf9/0x230 drivers/usb/core/hcd.c:1670 [] usb_hcd_giveback_urb+0x1b6/0x1d0 drivers/usb/core/hcd.c:1747 [] dummy_timer+0x8e4/0x14c0 drivers/usb/gadget/udc/dummy_hcd.c:1988 [] call_timer_fn+0x38/0x200 kernel/time/timer.c:1474 [] expire_timers kernel/time/timer.c:1519 [inline] [] __run_timers.part.0+0x316/0x430 kernel/time/timer.c:1790 [] __run_timers kernel/time/timer.c:1768 [inline] [] run_timer_softirq+0x44/0x90 kernel/time/timer.c:1803 [] __do_softirq+0xe6/0x2ea kernel/softirq.c:571 [] invoke_softirq kernel/softirq.c:445 [inline] [] __irq_exit_rcu kernel/softirq.c:650 [inline] [] irq_exit_rcu+0xc0/0x110 kernel/softirq.c:662 [] sysvec_apic_timer_interrupt+0xa2/0xd0 arch/x86/kernel/apic/apic.c:1106 [] asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:649 [] native_safe_halt arch/x86/include/asm/irqflags.h:51 [inline] [] arch_safe_halt arch/x86/include/asm/irqflags.h:89 [inline] [] acpi_safe_halt drivers/acpi/processor_idle.c:111 [inline] [] acpi_idle_do_entry+0xc0/0xd0 drivers/acpi/processor_idle.c:554

Affected

22 ranges
VendorProductVersion rangeFixed in
debianlinux< linux 6.0.2-1 (bookworm)linux 6.0.2-1 (bookworm)
linuxlinux——
linuxlinux>= 86166b7bcda0bcb53525114fa1c87ac432be478e < 1bea0bbf66001b0c7bf239a4d70eaf47824d3feb1bea0bbf66001b0c7bf239a4d70eaf47824d3feb
linuxlinux>= 86166b7bcda0bcb53525114fa1c87ac432be478e < c06b013f5cbfeafe0a9cfa5a7128604c34e0e517c06b013f5cbfeafe0a9cfa5a7128604c34e0e517
linuxlinux>= 86166b7bcda0bcb53525114fa1c87ac432be478e < f5b7e9611cffec345d62d5bdd8b6e30e89956818f5b7e9611cffec345d62d5bdd8b6e30e89956818
linuxlinux>= 86166b7bcda0bcb53525114fa1c87ac432be478e < 53c7c4d5d40b45c127cb1193bf3e9670f844c3cf53c7c4d5d40b45c127cb1193bf3e9670f844c3cf
linuxlinux>= 86166b7bcda0bcb53525114fa1c87ac432be478e < 7e2fa79226580b035b00260d9f240ab9bda4af5d7e2fa79226580b035b00260d9f240ab9bda4af5d
linuxlinux>= 86166b7bcda0bcb53525114fa1c87ac432be478e < dfd27a737283313a3e626e97b9d9b2d8d6a94188dfd27a737283313a3e626e97b9d9b2d8d6a94188
linuxlinux>= 86166b7bcda0bcb53525114fa1c87ac432be478e < 52a3c62a815161c2dcf38ac421f6c41d8679462b52a3c62a815161c2dcf38ac421f6c41d8679462b
linuxlinux>= 86166b7bcda0bcb53525114fa1c87ac432be478e < a5623a203cffe2d2b84d2f6c989d9017db1856afa5623a203cffe2d2b84d2f6c989d9017db1856af
linuxlinux_kernel——
linuxlinux_kernel>= 0 < 5.10.148-15.10.148-1
linuxlinux_kernel>= 0 < 6.0.2-16.0.2-1
linuxlinux_kernel>= 0 < 6.0.2-16.0.2-1
linuxlinux_kernel>= 0 < 6.0.2-16.0.2-1
linuxlinux_kernel>= 2.6.24 < 4.9.3274.9.327
linuxlinux_kernel>= 4.10 < 4.14.2924.14.292
linuxlinux_kernel>= 4.15 < 4.19.2574.19.257
linuxlinux_kernel>= 4.20 < 5.4.2125.4.212
linuxlinux_kernel>= 5.11 < 5.15.655.15.65
linuxlinux_kernel>= 5.16 < 5.19.75.19.7
linuxlinux_kernel>= 5.5 < 5.10.1415.10.141

CVSS provenance

nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.5MEDIUM
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.