Riskcovery

CVE-2022-48782

mctp: fix use after free

State
Published
Severity
8.8 High
Published
Jul 16, 2024
Updated
Aug 5, 2026
Reserved
Jun 20, 2024

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

mctp: fix use after free

Clang static analysis reports this problem route.c:425:4: warning: Use of memory after it is freed trace_mctp_key_acquire(key); ^~~~~~~~~~~~~~~~~~~~~~~~~~~ When mctp_key_add() fails, key is freed but then is later used in trace_mctp_key_acquire(). Add an else statement to use the key only when mctp_key_add() is successful.

Scores

CVSSScoreVectorSource
3.18.8 HighCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 4f9e1ba6de45aa8797a83f1fe5b82ec4bac16899 to before 1dd3ecbec5f606b2a526c47925c8634b1a6bb81eAffected
  • 4f9e1ba6de45aa8797a83f1fe5b82ec4bac16899 to before 7e5b6a5c8c44310784c88c1c198dde79f6402f7bAffected
LinuxLinux
  • 5.16Affected
  • before 5.16Not affected
  • 5.16.11 through 5.16.*Not affected
  • 5.17 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.