CVE-2022-49119

scsi: pm8001: Fix memory leak in pm8001_chip_fw_flash_update_req()

State: Published
Severity: 5.5 Medium
Published: Feb 26, 2025
Updated: May 11, 2026
Reserved: Feb 26, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

scsi: pm8001: Fix memory leak in pm8001_chip_fw_flash_update_req()

In pm8001_chip_fw_flash_update_build(), if pm8001_chip_fw_flash_update_build() fails, the struct fw_control_ex allocated must be freed.

Scores

CVSS	Score	Vector	Source
3.1	5.5 Medium	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H	CISA-ADP

Weaknesses

CWE-401 Missing Release of Memory after Effective Lifetime

Affected Products

Product	Versions
LinuxLinux	72d0baa089ebd058cdb8b87fde835e9157c4597a to before d83574666bac4b1462e90df393fbed6c5f57d1a3Affected 72d0baa089ebd058cdb8b87fde835e9157c4597a to before e5ecdb01952f230921aa8163d8d7f4c97c925ed8Affected 72d0baa089ebd058cdb8b87fde835e9157c4597a to before fe5b8ea5583b5c3f6f68e06acba50387edf3b5d5Affected 72d0baa089ebd058cdb8b87fde835e9157c4597a to before a25ed5f21f94f9ae4bcc8dd747e978668890c921Affected 72d0baa089ebd058cdb8b87fde835e9157c4597a to before f792a3629f4c4aa4c3703d66b43ce1edcc3ec09aAffected
LinuxLinux	2.6.33Affected before 2.6.33Not affected 5.10.111 through 5.10.Not affected 5.15.34 through 5.15.Not affected 5.16.20 through 5.16.Not affected 5.17.3 through 5.17.Not affected 5.18 and laterNot affected

Product

Versions

LinuxLinux

72d0baa089ebd058cdb8b87fde835e9157c4597a to before d83574666bac4b1462e90df393fbed6c5f57d1a3Affected
72d0baa089ebd058cdb8b87fde835e9157c4597a to before e5ecdb01952f230921aa8163d8d7f4c97c925ed8Affected
72d0baa089ebd058cdb8b87fde835e9157c4597a to before fe5b8ea5583b5c3f6f68e06acba50387edf3b5d5Affected
72d0baa089ebd058cdb8b87fde835e9157c4597a to before a25ed5f21f94f9ae4bcc8dd747e978668890c921Affected
72d0baa089ebd058cdb8b87fde835e9157c4597a to before f792a3629f4c4aa4c3703d66b43ce1edcc3ec09aAffected

LinuxLinux

2.6.33Affected
before 2.6.33Not affected
5.10.111 through 5.10.*Not affected
5.15.34 through 5.15.*Not affected
5.16.20 through 5.16.*Not affected
5.17.3 through 5.17.*Not affected
5.18 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.