Riskcovery

CVE-2022-49677

ARM: cns3xxx: Fix refcount leak in cns3xxx_init

State
Published
Severity
5.5 Medium
Published
Feb 26, 2025
Updated
May 11, 2026
Reserved
Feb 26, 2025

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

ARM: cns3xxx: Fix refcount leak in cns3xxx_init

of_find_compatible_node() returns a node pointer with refcount incremented, we should use of_node_put() on it when done. Add missing of_node_put() to avoid refcount leak.

Scores

CVSSScoreVectorSource
3.15.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HCISA-ADP

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 415f59142d9d9dd023deaeb3b4dfc1aecdd3983c to before b8b84e01ca94e2e1f5492353e9c24dab520b2e5bAffected
  • 415f59142d9d9dd023deaeb3b4dfc1aecdd3983c to before 45bebbc8cea7d586a6216dc62814bdb380b9b29bAffected
  • 415f59142d9d9dd023deaeb3b4dfc1aecdd3983c to before 68d4303bf59662b64bd555e2aa0518282d20aa4fAffected
  • 415f59142d9d9dd023deaeb3b4dfc1aecdd3983c to before d1359e4129ad43e43972a28838b87291c51de23dAffected
  • 415f59142d9d9dd023deaeb3b4dfc1aecdd3983c to before c980392af1473d6d5662f70d8089c8e6d85144a4Affected
  • 415f59142d9d9dd023deaeb3b4dfc1aecdd3983c to before da3ee7cd2f15922ad88a7ca6deee2eafdc7cd214Affected
  • 415f59142d9d9dd023deaeb3b4dfc1aecdd3983c to before dc5170aae24e04068fd5ea125d06c0ab51f48a27Affected
  • 415f59142d9d9dd023deaeb3b4dfc1aecdd3983c to before 1ba904b6b16e08de5aed7c1349838d9cd0d178c5Affected
LinuxLinux
  • 3.10Affected
  • before 3.10Not affected
  • 4.9.321 through 4.9.*Not affected
  • 4.14.286 through 4.14.*Not affected
  • 4.19.250 through 4.19.*Not affected
  • 5.4.202 through 5.4.*Not affected
  • 5.10.127 through 5.10.*Not affected
  • 5.15.51 through 5.15.*Not affected
  • 5.18.8 through 5.18.*Not affected
  • 5.19 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.