CVE-2022-49331

nfc: st21nfca: fix memory leaks in EVT_TRANSACTION handling

State: Published
Severity: 5.5 Medium
Published: Feb 26, 2025
Updated: May 11, 2026
Reserved: Feb 26, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

nfc: st21nfca: fix memory leaks in EVT_TRANSACTION handling

Error paths do not free previously allocated memory. Add devm_kfree() to those failure paths.

Scores

CVSS	Score	Vector	Source
3.1	5.5 Medium	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H	CISA-ADP

Weaknesses

CWE-401 Missing Release of Memory after Effective Lifetime

Affected Products

Product	Versions
LinuxLinux	26fc6c7f02cb26c39c4733de3dbc3c0646fc1074 to before 593773088d615a46a42c97e01a0550d192bb7f74Affected 26fc6c7f02cb26c39c4733de3dbc3c0646fc1074 to before d221ce54ce331c1a23be71eebf57f6a088632383Affected 26fc6c7f02cb26c39c4733de3dbc3c0646fc1074 to before 6fce324b530dd74750ad870699e33eeed1029dedAffected 26fc6c7f02cb26c39c4733de3dbc3c0646fc1074 to before 3eca2c42daa4659965db6817479027cbc6df7899Affected 26fc6c7f02cb26c39c4733de3dbc3c0646fc1074 to before 54423649bc0ed464b75807a7cf2857a5871f738fAffected 26fc6c7f02cb26c39c4733de3dbc3c0646fc1074 to before f444ecd3f57f4ba5090fe8b6756933e37de4226eAffected 26fc6c7f02cb26c39c4733de3dbc3c0646fc1074 to before db836b97464d44340b568e041fd24602858713f7Affected 26fc6c7f02cb26c39c4733de3dbc3c0646fc1074 to before 55904086041ba4ee4070187b36590f8f8d6df4cdAffected 26fc6c7f02cb26c39c4733de3dbc3c0646fc1074 to before 996419e0594abb311fb958553809f24f38e7abbeAffected
LinuxLinux	4.0Affected before 4.0Not affected 4.9.318 through 4.9.Not affected 4.14.283 through 4.14.Not affected 4.19.247 through 4.19.Not affected 5.4.198 through 5.4.Not affected 5.10.122 through 5.10.Not affected 5.15.47 through 5.15.Not affected 5.17.15 through 5.17.Not affected 5.18.4 through 5.18.Not affected 5.19 and laterNot affected

Product

Versions

LinuxLinux

26fc6c7f02cb26c39c4733de3dbc3c0646fc1074 to before 593773088d615a46a42c97e01a0550d192bb7f74Affected
26fc6c7f02cb26c39c4733de3dbc3c0646fc1074 to before d221ce54ce331c1a23be71eebf57f6a088632383Affected
26fc6c7f02cb26c39c4733de3dbc3c0646fc1074 to before 6fce324b530dd74750ad870699e33eeed1029dedAffected
26fc6c7f02cb26c39c4733de3dbc3c0646fc1074 to before 3eca2c42daa4659965db6817479027cbc6df7899Affected
26fc6c7f02cb26c39c4733de3dbc3c0646fc1074 to before 54423649bc0ed464b75807a7cf2857a5871f738fAffected
26fc6c7f02cb26c39c4733de3dbc3c0646fc1074 to before f444ecd3f57f4ba5090fe8b6756933e37de4226eAffected
26fc6c7f02cb26c39c4733de3dbc3c0646fc1074 to before db836b97464d44340b568e041fd24602858713f7Affected
26fc6c7f02cb26c39c4733de3dbc3c0646fc1074 to before 55904086041ba4ee4070187b36590f8f8d6df4cdAffected
26fc6c7f02cb26c39c4733de3dbc3c0646fc1074 to before 996419e0594abb311fb958553809f24f38e7abbeAffected

LinuxLinux

4.0Affected
before 4.0Not affected
4.9.318 through 4.9.*Not affected
4.14.283 through 4.14.*Not affected
4.19.247 through 4.19.*Not affected
5.4.198 through 5.4.*Not affected
5.10.122 through 5.10.*Not affected
5.15.47 through 5.15.*Not affected
5.17.15 through 5.17.*Not affected
5.18.4 through 5.18.*Not affected
5.19 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.