CVE-2022-49619

net: sfp: fix memory leak in sfp_probe()

State: Published
Severity: 5.5 Medium
Published: Feb 26, 2025
Updated: May 11, 2026
Reserved: Feb 26, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

net: sfp: fix memory leak in sfp_probe()

sfp_probe() allocates a memory chunk from sfp with sfp_alloc(). When devm_add_action() fails, sfp is not freed, which leads to a memory leak.

We should use devm_add_action_or_reset() instead of devm_add_action().

Scores

CVSS	Score	Vector	Source
3.1	5.5 Medium	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H	CISA-ADP

Weaknesses

CWE-401 Missing Release of Memory after Effective Lifetime

Affected Products

Product	Versions
LinuxLinux	73970055450eebc6fc36fd170e56cc45889d0093 to before 9ec5a97f327a89031fce6cfc3e95543c53936638Affected 73970055450eebc6fc36fd170e56cc45889d0093 to before 1545bc727625ea6e8decd717e5d1e8cc704ccf8fAffected 73970055450eebc6fc36fd170e56cc45889d0093 to before ede990cfc42775bd0141e21f37ee365dcaeeb50fAffected 73970055450eebc6fc36fd170e56cc45889d0093 to before 67dc32542a1fb7790d0853cf4a5cf859ac6a2002Affected 73970055450eebc6fc36fd170e56cc45889d0093 to before 204543581a2f26bb3b997a304c0bd06926ba7f15Affected 73970055450eebc6fc36fd170e56cc45889d0093 to before f22ddc8a5278d7fb6369a0aeb0d8775a0aefaaeeAffected 73970055450eebc6fc36fd170e56cc45889d0093 to before 0a18d802d65cf662644fd1d369c86d84a5630652Affected
LinuxLinux	4.14Affected before 4.14Not affected 4.14.289 through 4.14.Not affected 4.19.253 through 4.19.Not affected 5.4.207 through 5.4.Not affected 5.10.132 through 5.10.Not affected 5.15.56 through 5.15.Not affected 5.18.13 through 5.18.Not affected 5.19 and laterNot affected

Product

Versions

LinuxLinux

73970055450eebc6fc36fd170e56cc45889d0093 to before 9ec5a97f327a89031fce6cfc3e95543c53936638Affected
73970055450eebc6fc36fd170e56cc45889d0093 to before 1545bc727625ea6e8decd717e5d1e8cc704ccf8fAffected
73970055450eebc6fc36fd170e56cc45889d0093 to before ede990cfc42775bd0141e21f37ee365dcaeeb50fAffected
73970055450eebc6fc36fd170e56cc45889d0093 to before 67dc32542a1fb7790d0853cf4a5cf859ac6a2002Affected
73970055450eebc6fc36fd170e56cc45889d0093 to before 204543581a2f26bb3b997a304c0bd06926ba7f15Affected
73970055450eebc6fc36fd170e56cc45889d0093 to before f22ddc8a5278d7fb6369a0aeb0d8775a0aefaaeeAffected
73970055450eebc6fc36fd170e56cc45889d0093 to before 0a18d802d65cf662644fd1d369c86d84a5630652Affected

LinuxLinux

4.14Affected
before 4.14Not affected
4.14.289 through 4.14.*Not affected
4.19.253 through 4.19.*Not affected
5.4.207 through 5.4.*Not affected
5.10.132 through 5.10.*Not affected
5.15.56 through 5.15.*Not affected
5.18.13 through 5.18.*Not affected
5.19 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.