CVE-2022-49712

usb: gadget: lpc32xx_udc: Fix refcount leak in lpc32xx_udc_probe

State: Published
Severity: 5.5 Medium
Published: Feb 26, 2025
Updated: May 11, 2026
Reserved: Feb 26, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: lpc32xx_udc: Fix refcount leak in lpc32xx_udc_probe

of_parse_phandle() returns a node pointer with refcount incremented, we should use of_node_put() on it when not need anymore. Add missing of_node_put() to avoid refcount leak. of_node_put() will check NULL pointer.

Scores

CVSS	Score	Vector	Source
3.1	5.5 Medium	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H	CISA-ADP

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	24a28e4283510dcd58890379a42b8a7d3201d9d3 to before d85e4e6284a91aa2d1ab004e9d84b9c09b4aa203Affected 24a28e4283510dcd58890379a42b8a7d3201d9d3 to before 0ef6917c0524da5b88496b9706628ffef108b9bbAffected 24a28e4283510dcd58890379a42b8a7d3201d9d3 to before 2a598da14856ead80c726b38ba426c68637d9211Affected 24a28e4283510dcd58890379a42b8a7d3201d9d3 to before b75bddfcc18170ce8e3fb695a76ec2dec4ce0ea5Affected 24a28e4283510dcd58890379a42b8a7d3201d9d3 to before 57901c658f77d9ea2e772f35cb38e47efb54c558Affected 24a28e4283510dcd58890379a42b8a7d3201d9d3 to before 46da1e4a8b6329479433b2a4056941dfdd7f3efdAffected 24a28e4283510dcd58890379a42b8a7d3201d9d3 to before 727c82d003e0ec64411fd1257a9a57de4ad7a99aAffected 24a28e4283510dcd58890379a42b8a7d3201d9d3 to before 4757c9ade34178b351580133771f510b5ffcf9c8Affected
LinuxLinux	3.5Affected before 3.5Not affected 4.9.320 through 4.9.Not affected 4.14.285 through 4.14.Not affected 4.19.249 through 4.19.Not affected 5.4.200 through 5.4.Not affected 5.10.124 through 5.10.Not affected 5.15.49 through 5.15.Not affected 5.18.6 through 5.18.*Not affected 5.19 and laterNot affected

Product

Versions

LinuxLinux

24a28e4283510dcd58890379a42b8a7d3201d9d3 to before d85e4e6284a91aa2d1ab004e9d84b9c09b4aa203Affected
24a28e4283510dcd58890379a42b8a7d3201d9d3 to before 0ef6917c0524da5b88496b9706628ffef108b9bbAffected
24a28e4283510dcd58890379a42b8a7d3201d9d3 to before 2a598da14856ead80c726b38ba426c68637d9211Affected
24a28e4283510dcd58890379a42b8a7d3201d9d3 to before b75bddfcc18170ce8e3fb695a76ec2dec4ce0ea5Affected
24a28e4283510dcd58890379a42b8a7d3201d9d3 to before 57901c658f77d9ea2e772f35cb38e47efb54c558Affected
24a28e4283510dcd58890379a42b8a7d3201d9d3 to before 46da1e4a8b6329479433b2a4056941dfdd7f3efdAffected
24a28e4283510dcd58890379a42b8a7d3201d9d3 to before 727c82d003e0ec64411fd1257a9a57de4ad7a99aAffected
24a28e4283510dcd58890379a42b8a7d3201d9d3 to before 4757c9ade34178b351580133771f510b5ffcf9c8Affected

LinuxLinux

3.5Affected
before 3.5Not affected
4.9.320 through 4.9.*Not affected
4.14.285 through 4.14.*Not affected
4.19.249 through 4.19.*Not affected
5.4.200 through 5.4.*Not affected
5.10.124 through 5.10.*Not affected
5.15.49 through 5.15.*Not affected
5.18.6 through 5.18.*Not affected
5.19 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.