CVE-2022-49389

usb: usbip: fix a refcount leak in stub_probe()

State: Published
Severity: 5.5 Medium
Published: Feb 26, 2025
Updated: May 23, 2026
Reserved: Feb 26, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

usb: usbip: fix a refcount leak in stub_probe()

usb_get_dev() is called in stub_device_alloc(). When stub_probe() fails after that, usb_put_dev() needs to be called to release the reference.

Fix this by moving usb_put_dev() to sdev_free error path handling.

Find this by code review.

Scores

CVSS	Score	Vector	Source
3.1	5.5 Medium	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H	CISA-ADP

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	3ff67445750a84de67faaf52c6e1895cb09f2c56 to before 6bafee2f18af5e5ac125e42960bc65496d0e56a0Affected 3ff67445750a84de67faaf52c6e1895cb09f2c56 to before f20d2d3b3364ce6525c050a8b6b4c54c8c19674dAffected 3ff67445750a84de67faaf52c6e1895cb09f2c56 to before 247d3809e45a34d9e1a3a2bb7012e31ed8b46031Affected 3ff67445750a84de67faaf52c6e1895cb09f2c56 to before 2f0ae93ec33c8456cdfbf7876b80403a6318ebceAffected 3ff67445750a84de67faaf52c6e1895cb09f2c56 to before bcbb795a9e78180d74c6ab21518da87e803dfdceAffected 3ff67445750a84de67faaf52c6e1895cb09f2c56 to before 51422046be504515eb5a591adf0f424b62f46804Affected 3ff67445750a84de67faaf52c6e1895cb09f2c56 to before 8afb048800919d0ab10c57983940eba956339f21Affected 3ff67445750a84de67faaf52c6e1895cb09f2c56 to before 11c65408bd0ba1d9cd1307caa38169292de9cdfbAffected 3ff67445750a84de67faaf52c6e1895cb09f2c56 to before 9ec4cbf1cc55d126759051acfe328d489c5d6e60Affected 77e7f91231bf63e3c64eb59a2aaf5754eaea2e69Affected d0f35e23dafa0185f979d0c70463caa658062264Affected 3.16.58 to before 3.17Affected 3.18.110 to before 3.19Affected
LinuxLinux	3.19Affected before 3.19Not affected 4.9.318 through 4.9.Not affected 4.14.283 through 4.14.Not affected 4.19.247 through 4.19.Not affected 5.4.198 through 5.4.Not affected 5.10.122 through 5.10.Not affected 5.15.47 through 5.15.Not affected 5.17.15 through 5.17.Not affected 5.18.4 through 5.18.Not affected 5.19 and laterNot affected

Product

Versions

LinuxLinux

3ff67445750a84de67faaf52c6e1895cb09f2c56 to before 6bafee2f18af5e5ac125e42960bc65496d0e56a0Affected
3ff67445750a84de67faaf52c6e1895cb09f2c56 to before f20d2d3b3364ce6525c050a8b6b4c54c8c19674dAffected
3ff67445750a84de67faaf52c6e1895cb09f2c56 to before 247d3809e45a34d9e1a3a2bb7012e31ed8b46031Affected
3ff67445750a84de67faaf52c6e1895cb09f2c56 to before 2f0ae93ec33c8456cdfbf7876b80403a6318ebceAffected
3ff67445750a84de67faaf52c6e1895cb09f2c56 to before bcbb795a9e78180d74c6ab21518da87e803dfdceAffected
3ff67445750a84de67faaf52c6e1895cb09f2c56 to before 51422046be504515eb5a591adf0f424b62f46804Affected
3ff67445750a84de67faaf52c6e1895cb09f2c56 to before 8afb048800919d0ab10c57983940eba956339f21Affected
3ff67445750a84de67faaf52c6e1895cb09f2c56 to before 11c65408bd0ba1d9cd1307caa38169292de9cdfbAffected
3ff67445750a84de67faaf52c6e1895cb09f2c56 to before 9ec4cbf1cc55d126759051acfe328d489c5d6e60Affected
77e7f91231bf63e3c64eb59a2aaf5754eaea2e69Affected
d0f35e23dafa0185f979d0c70463caa658062264Affected
3.16.58 to before 3.17Affected
3.18.110 to before 3.19Affected

LinuxLinux

3.19Affected
before 3.19Not affected
4.9.318 through 4.9.*Not affected
4.14.283 through 4.14.*Not affected
4.19.247 through 4.19.*Not affected
5.4.198 through 5.4.*Not affected
5.10.122 through 5.10.*Not affected
5.15.47 through 5.15.*Not affected
5.17.15 through 5.17.*Not affected
5.18.4 through 5.18.*Not affected
5.19 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.