CVE-2022-49508

HID: elan: Fix potential double free in elan_input_configured

State: Published
Severity: 7.8 High
Published: Feb 26, 2025
Updated: May 11, 2026
Reserved: Feb 26, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

HID: elan: Fix potential double free in elan_input_configured

'input' is a managed resource allocated with devm_input_allocate_device(), so there is no need to call input_free_device() explicitly or there will be a double free.

According to the doc of devm_input_allocate_device(): * Managed input devices do not need to be explicitly unregistered or * freed as it will be done automatically when owner device unbinds from * its driver (or binding fails).

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	CISA-ADP

Weaknesses

CWE-415 Double Free

Affected Products

Product	Versions
LinuxLinux	9a6a4193d65b853020ef0e66cecdf9e64a863883 to before c92ec22a991778a096342cf1a917ae36c5c86a90Affected 9a6a4193d65b853020ef0e66cecdf9e64a863883 to before f1d4f19a796551edc6679a681ea1756b8c578c08Affected 9a6a4193d65b853020ef0e66cecdf9e64a863883 to before 6d0726725c7c560495f5ff364862a2cefea542e3Affected 9a6a4193d65b853020ef0e66cecdf9e64a863883 to before 24f9dfdaece9bd75bb8dbfdba83eddeefdf7dc47Affected 9a6a4193d65b853020ef0e66cecdf9e64a863883 to before 5291451851feeb66fd4bf0826710f482f3b1ab38Affected 9a6a4193d65b853020ef0e66cecdf9e64a863883 to before 8bb1716507ebf12d50bbf181764481de3b6bc7fdAffected 9a6a4193d65b853020ef0e66cecdf9e64a863883 to before 1af20714fedad238362571620be0bd690ded05b6Affected
LinuxLinux	4.17Affected before 4.17Not affected 4.19.247 through 4.19.Not affected 5.4.198 through 5.4.Not affected 5.10.121 through 5.10.Not affected 5.15.46 through 5.15.Not affected 5.17.14 through 5.17.Not affected 5.18.3 through 5.18.Not affected 5.19 and laterNot affected

Product

Versions

LinuxLinux

9a6a4193d65b853020ef0e66cecdf9e64a863883 to before c92ec22a991778a096342cf1a917ae36c5c86a90Affected
9a6a4193d65b853020ef0e66cecdf9e64a863883 to before f1d4f19a796551edc6679a681ea1756b8c578c08Affected
9a6a4193d65b853020ef0e66cecdf9e64a863883 to before 6d0726725c7c560495f5ff364862a2cefea542e3Affected
9a6a4193d65b853020ef0e66cecdf9e64a863883 to before 24f9dfdaece9bd75bb8dbfdba83eddeefdf7dc47Affected
9a6a4193d65b853020ef0e66cecdf9e64a863883 to before 5291451851feeb66fd4bf0826710f482f3b1ab38Affected
9a6a4193d65b853020ef0e66cecdf9e64a863883 to before 8bb1716507ebf12d50bbf181764481de3b6bc7fdAffected
9a6a4193d65b853020ef0e66cecdf9e64a863883 to before 1af20714fedad238362571620be0bd690ded05b6Affected

LinuxLinux

4.17Affected
before 4.17Not affected
4.19.247 through 4.19.*Not affected
5.4.198 through 5.4.*Not affected
5.10.121 through 5.10.*Not affected
5.15.46 through 5.15.*Not affected
5.17.14 through 5.17.*Not affected
5.18.3 through 5.18.*Not affected
5.19 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.