CVE-2022-49370

firmware: dmi-sysfs: Fix memory leak in dmi_sysfs_register_handle

State: Published
Severity: 5.5 Medium
Published: Feb 26, 2025
Updated: May 11, 2026
Reserved: Feb 26, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

firmware: dmi-sysfs: Fix memory leak in dmi_sysfs_register_handle

kobject_init_and_add() takes reference even when it fails. According to the doc of kobject_init_and_add()

If this function returns an error, kobject_put() must be called to properly clean up the memory associated with the object.

Fix this issue by calling kobject_put().

Scores

CVSS	Score	Vector	Source
3.1	5.5 Medium	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H	CISA-ADP

Weaknesses

CWE-401 Missing Release of Memory after Effective Lifetime

Affected Products

Product	Versions
LinuxLinux	948af1f0bbc8526448e8cbe3f8d3bf211bdf5181 to before a9bfb37d6ba7c376b0d53337a4c5f5ff324bd725Affected 948af1f0bbc8526448e8cbe3f8d3bf211bdf5181 to before ed38d04342dfbe9e5aca745c8b5eb4188a74f0efAffected 948af1f0bbc8526448e8cbe3f8d3bf211bdf5181 to before c66cc3c62870a27ea8f060a7e4c1ad8d26dd3f0dAffected 948af1f0bbc8526448e8cbe3f8d3bf211bdf5181 to before a724634b2a49f6ff0177a9e19a5a92fc1545e1b7Affected 948af1f0bbc8526448e8cbe3f8d3bf211bdf5181 to before 985706bd3bbeffc8737bc05965ca8d24837bc7dbAffected 948af1f0bbc8526448e8cbe3f8d3bf211bdf5181 to before fdffa4ad8f6bf1ece877edfb807f2b2c729d8578Affected 948af1f0bbc8526448e8cbe3f8d3bf211bdf5181 to before 3ba359ebe914ac3f8c6c832b28007c14c39d3766Affected 948af1f0bbc8526448e8cbe3f8d3bf211bdf5181 to before ec752973aa721ee281d5441e497364637c626c7bAffected 948af1f0bbc8526448e8cbe3f8d3bf211bdf5181 to before 660ba678f9998aca6db74f2dd912fa5124f0fa31Affected
LinuxLinux	2.6.39Affected before 2.6.39Not affected 4.9.318 through 4.9.Not affected 4.14.283 through 4.14.Not affected 4.19.247 through 4.19.Not affected 5.4.198 through 5.4.Not affected 5.10.122 through 5.10.Not affected 5.15.47 through 5.15.Not affected 5.17.15 through 5.17.Not affected 5.18.4 through 5.18.Not affected 5.19 and laterNot affected

Product

Versions

LinuxLinux

948af1f0bbc8526448e8cbe3f8d3bf211bdf5181 to before a9bfb37d6ba7c376b0d53337a4c5f5ff324bd725Affected
948af1f0bbc8526448e8cbe3f8d3bf211bdf5181 to before ed38d04342dfbe9e5aca745c8b5eb4188a74f0efAffected
948af1f0bbc8526448e8cbe3f8d3bf211bdf5181 to before c66cc3c62870a27ea8f060a7e4c1ad8d26dd3f0dAffected
948af1f0bbc8526448e8cbe3f8d3bf211bdf5181 to before a724634b2a49f6ff0177a9e19a5a92fc1545e1b7Affected
948af1f0bbc8526448e8cbe3f8d3bf211bdf5181 to before 985706bd3bbeffc8737bc05965ca8d24837bc7dbAffected
948af1f0bbc8526448e8cbe3f8d3bf211bdf5181 to before fdffa4ad8f6bf1ece877edfb807f2b2c729d8578Affected
948af1f0bbc8526448e8cbe3f8d3bf211bdf5181 to before 3ba359ebe914ac3f8c6c832b28007c14c39d3766Affected
948af1f0bbc8526448e8cbe3f8d3bf211bdf5181 to before ec752973aa721ee281d5441e497364637c626c7bAffected
948af1f0bbc8526448e8cbe3f8d3bf211bdf5181 to before 660ba678f9998aca6db74f2dd912fa5124f0fa31Affected

LinuxLinux

2.6.39Affected
before 2.6.39Not affected
4.9.318 through 4.9.*Not affected
4.14.283 through 4.14.*Not affected
4.19.247 through 4.19.*Not affected
5.4.198 through 5.4.*Not affected
5.10.122 through 5.10.*Not affected
5.15.47 through 5.15.*Not affected
5.17.15 through 5.17.*Not affected
5.18.4 through 5.18.*Not affected
5.19 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.