CVE-2022-49657

usbnet: fix memory leak in error case

State: Published
Severity: 5.5 Medium
Published: Feb 26, 2025
Updated: May 11, 2026
Reserved: Feb 26, 2025

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

usbnet: fix memory leak in error case

usbnet_write_cmd_async() mixed up which buffers need to be freed in which error case.

v2: add Fixes tag v3: fix uninitialized buf pointer

Scores

CVSS	Score	Vector	Source
3.1	5.5 Medium	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H	CISA-ADP

Weaknesses

CWE-401 Missing Release of Memory after Effective Lifetime

Affected Products

Product	Versions
LinuxLinux	877bd862f32b815d54ab5fc10a4fd903d7bf3012 to before 3eed421ca5c809da93456f69203d164d5220be3dAffected 877bd862f32b815d54ab5fc10a4fd903d7bf3012 to before 5269209f54dd8dfd15f9383f3a3a1fe8370764f8Affected 877bd862f32b815d54ab5fc10a4fd903d7bf3012 to before d5165e657987ff4ba0ace896d4376a3718a9fbc3Affected 877bd862f32b815d54ab5fc10a4fd903d7bf3012 to before 04894ab34faf40ab72a8a5ab5b404bb0606bbbffAffected 877bd862f32b815d54ab5fc10a4fd903d7bf3012 to before 0085da9df3dced730027923a6b48f58e9016af91Affected 877bd862f32b815d54ab5fc10a4fd903d7bf3012 to before db89582ff330556188da856e01382ccbf3a5e706Affected 877bd862f32b815d54ab5fc10a4fd903d7bf3012 to before e7b4f69946a38209b4a4f660bf0e4cbed94f9b4bAffected 877bd862f32b815d54ab5fc10a4fd903d7bf3012 to before b55a21b764c1e182014630fa5486d717484ac58fAffected
LinuxLinux	3.8Affected before 3.8Not affected 4.9.323 through 4.9.Not affected 4.14.288 through 4.14.Not affected 4.19.252 through 4.19.Not affected 5.4.205 through 5.4.Not affected 5.10.130 through 5.10.Not affected 5.15.54 through 5.15.Not affected 5.18.11 through 5.18.*Not affected 5.19 and laterNot affected

Product

Versions

LinuxLinux

877bd862f32b815d54ab5fc10a4fd903d7bf3012 to before 3eed421ca5c809da93456f69203d164d5220be3dAffected
877bd862f32b815d54ab5fc10a4fd903d7bf3012 to before 5269209f54dd8dfd15f9383f3a3a1fe8370764f8Affected
877bd862f32b815d54ab5fc10a4fd903d7bf3012 to before d5165e657987ff4ba0ace896d4376a3718a9fbc3Affected
877bd862f32b815d54ab5fc10a4fd903d7bf3012 to before 04894ab34faf40ab72a8a5ab5b404bb0606bbbffAffected
877bd862f32b815d54ab5fc10a4fd903d7bf3012 to before 0085da9df3dced730027923a6b48f58e9016af91Affected
877bd862f32b815d54ab5fc10a4fd903d7bf3012 to before db89582ff330556188da856e01382ccbf3a5e706Affected
877bd862f32b815d54ab5fc10a4fd903d7bf3012 to before e7b4f69946a38209b4a4f660bf0e4cbed94f9b4bAffected
877bd862f32b815d54ab5fc10a4fd903d7bf3012 to before b55a21b764c1e182014630fa5486d717484ac58fAffected

LinuxLinux

3.8Affected
before 3.8Not affected
4.9.323 through 4.9.*Not affected
4.14.288 through 4.14.*Not affected
4.19.252 through 4.19.*Not affected
5.4.205 through 5.4.*Not affected
5.10.130 through 5.10.*Not affected
5.15.54 through 5.15.*Not affected
5.18.11 through 5.18.*Not affected
5.19 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.