CVE-2022-49346

net: dsa: lantiq_gswip: Fix refcount leak in gswip_gphy_fw_list

State: Published
Severity: 5.5 Medium
Published: Feb 26, 2025
Updated: May 11, 2026
Reserved: Feb 26, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

net: dsa: lantiq_gswip: Fix refcount leak in gswip_gphy_fw_list

Every iteration of for_each_available_child_of_node() decrements the reference count of the previous node. when breaking early from a for_each_available_child_of_node() loop, we need to explicitly call of_node_put() on the gphy_fw_np. Add missing of_node_put() to avoid refcount leak.

Scores

CVSS	Score	Vector	Source
3.1	5.5 Medium	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H	CISA-ADP

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	14fceff4771e51b23b4485b575cf9e5b3414b89b to before 7c8df6fad43d9d5d77f281f794b2a93cd02fd1a9Affected 14fceff4771e51b23b4485b575cf9e5b3414b89b to before c2ae49a113a5344232f1ebb93bcf18bbd11e9c39Affected 14fceff4771e51b23b4485b575cf9e5b3414b89b to before 54d6802c4d83fa8de7696cfec06f475d5fd92d27Affected 14fceff4771e51b23b4485b575cf9e5b3414b89b to before 32cd78c5610f02a929f63cac985e73692d05f33eAffected 14fceff4771e51b23b4485b575cf9e5b3414b89b to before 2e007ac6fa7c9c94ad84da075c5c504afad690a0Affected 14fceff4771e51b23b4485b575cf9e5b3414b89b to before 0737e018a05e2aa352828c52bdeed3b02cff2930Affected
LinuxLinux	4.20Affected before 4.20Not affected 5.4.198 through 5.4.Not affected 5.10.122 through 5.10.Not affected 5.15.47 through 5.15.Not affected 5.17.15 through 5.17.Not affected 5.18.4 through 5.18.*Not affected 5.19 and laterNot affected

Product

Versions

LinuxLinux

14fceff4771e51b23b4485b575cf9e5b3414b89b to before 7c8df6fad43d9d5d77f281f794b2a93cd02fd1a9Affected
14fceff4771e51b23b4485b575cf9e5b3414b89b to before c2ae49a113a5344232f1ebb93bcf18bbd11e9c39Affected
14fceff4771e51b23b4485b575cf9e5b3414b89b to before 54d6802c4d83fa8de7696cfec06f475d5fd92d27Affected
14fceff4771e51b23b4485b575cf9e5b3414b89b to before 32cd78c5610f02a929f63cac985e73692d05f33eAffected
14fceff4771e51b23b4485b575cf9e5b3414b89b to before 2e007ac6fa7c9c94ad84da075c5c504afad690a0Affected
14fceff4771e51b23b4485b575cf9e5b3414b89b to before 0737e018a05e2aa352828c52bdeed3b02cff2930Affected

LinuxLinux

4.20Affected
before 4.20Not affected
5.4.198 through 5.4.*Not affected
5.10.122 through 5.10.*Not affected
5.15.47 through 5.15.*Not affected
5.17.15 through 5.17.*Not affected
5.18.4 through 5.18.*Not affected
5.19 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.