CVE-2022-49284

coresight: syscfg: Fix memleak on registration failure in cscfg_create_device

State: Published
Severity: 5.5 Medium
Published: Feb 26, 2025
Updated: May 11, 2026
Reserved: Feb 26, 2025

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

coresight: syscfg: Fix memleak on registration failure in cscfg_create_device

device_register() calls device_initialize(), according to doc of device_initialize:

Use put_device() to give up your reference instead of freeing * @dev directly once you have called this function.

To prevent potential memleak, use put_device() for error handling.

Scores

CVSS	Score	Vector	Source
3.1	5.5 Medium	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H	CISA-ADP

Weaknesses

CWE-401 Missing Release of Memory after Effective Lifetime

Affected Products

Product	Versions
LinuxLinux	85e2414c518a03a21dddd4bc88fec2723c5e1197 to before c61e2fc87f24cae4701f352fe9ecd4c5c143106cAffected 85e2414c518a03a21dddd4bc88fec2723c5e1197 to before a529af1f5a5c096f3e18f0d5a32cfcc3d82df1ecAffected 85e2414c518a03a21dddd4bc88fec2723c5e1197 to before 412225b32986d5b11c3c1ad9234c50a3f5c52c76Affected 85e2414c518a03a21dddd4bc88fec2723c5e1197 to before cfa5dbcdd7aece76f3415284569f2f384aff0253Affected
LinuxLinux	5.15Affected before 5.15Not affected 5.15.33 through 5.15.Not affected 5.16.19 through 5.16.Not affected 5.17.2 through 5.17.*Not affected 5.18 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.