CVE-2022-49388

ubi: ubi_create_volume: Fix use-after-free when volume creation failed

State: Published
Severity: 7.8 High
Published: Feb 26, 2025
Updated: May 11, 2026
Reserved: Feb 26, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

ubi: ubi_create_volume: Fix use-after-free when volume creation failed

There is an use-after-free problem for 'eba_tbl' in ubi_create_volume()'s error handling path:

ubi_eba_replace_table(vol, eba_tbl) vol->eba_tbl = tbl out_mapping: ubi_eba_destroy_table(eba_tbl) // Free 'eba_tbl' out_unlock: put_device(&vol->dev) vol_release kfree(tbl->entries) // UAF

Fix it by removing redundant 'eba_tbl' releasing. Fetch a reproducer in [Link].

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	CISA-ADP

Weaknesses

CWE-416 Use After Free

Affected Products

Product	Versions
LinuxLinux	493cfaeaa0c9bc0c79ce5751193d49fdac9aaaec to before 25ff1e3a1351c0d936dd1ac2f9e58231ea1510c9Affected 493cfaeaa0c9bc0c79ce5751193d49fdac9aaaec to before abb67043060f2bf4c03d7c3debb9ae980e2b6db3Affected 493cfaeaa0c9bc0c79ce5751193d49fdac9aaaec to before 8302620aeb940f386817321d272b12411ae7d39fAffected 493cfaeaa0c9bc0c79ce5751193d49fdac9aaaec to before 6d8d3f68cbecfd31925796f0fb668eb21ab06734Affected 493cfaeaa0c9bc0c79ce5751193d49fdac9aaaec to before 5ff2514e4fb55dcf3d88294686040ca73ea0c1a2Affected 493cfaeaa0c9bc0c79ce5751193d49fdac9aaaec to before e27ecf325e51abd06aaefba57a6322a46fa4178bAffected 493cfaeaa0c9bc0c79ce5751193d49fdac9aaaec to before 1174ab8ba36a48025b68b5ff1085000b1e510217Affected 493cfaeaa0c9bc0c79ce5751193d49fdac9aaaec to before 8c03a1c21d72210f81cb369cc528e3fde4b45411Affected
LinuxLinux	4.12Affected before 4.12Not affected 4.14.283 through 4.14.Not affected 4.19.247 through 4.19.Not affected 5.4.198 through 5.4.Not affected 5.10.122 through 5.10.Not affected 5.15.47 through 5.15.Not affected 5.17.15 through 5.17.Not affected 5.18.4 through 5.18.*Not affected 5.19 and laterNot affected

Product

Versions

LinuxLinux

493cfaeaa0c9bc0c79ce5751193d49fdac9aaaec to before 25ff1e3a1351c0d936dd1ac2f9e58231ea1510c9Affected
493cfaeaa0c9bc0c79ce5751193d49fdac9aaaec to before abb67043060f2bf4c03d7c3debb9ae980e2b6db3Affected
493cfaeaa0c9bc0c79ce5751193d49fdac9aaaec to before 8302620aeb940f386817321d272b12411ae7d39fAffected
493cfaeaa0c9bc0c79ce5751193d49fdac9aaaec to before 6d8d3f68cbecfd31925796f0fb668eb21ab06734Affected
493cfaeaa0c9bc0c79ce5751193d49fdac9aaaec to before 5ff2514e4fb55dcf3d88294686040ca73ea0c1a2Affected
493cfaeaa0c9bc0c79ce5751193d49fdac9aaaec to before e27ecf325e51abd06aaefba57a6322a46fa4178bAffected
493cfaeaa0c9bc0c79ce5751193d49fdac9aaaec to before 1174ab8ba36a48025b68b5ff1085000b1e510217Affected
493cfaeaa0c9bc0c79ce5751193d49fdac9aaaec to before 8c03a1c21d72210f81cb369cc528e3fde4b45411Affected

LinuxLinux

4.12Affected
before 4.12Not affected
4.14.283 through 4.14.*Not affected
4.19.247 through 4.19.*Not affected
5.4.198 through 5.4.*Not affected
5.10.122 through 5.10.*Not affected
5.15.47 through 5.15.*Not affected
5.17.15 through 5.17.*Not affected
5.18.4 through 5.18.*Not affected
5.19 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.