CVE-2022-49713

usb: dwc2: Fix memory leak in dwc2_hcd_init

State: Published
Severity: 5.5 Medium
Published: Feb 26, 2025
Updated: May 23, 2026
Reserved: Feb 26, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

usb: dwc2: Fix memory leak in dwc2_hcd_init

usb_create_hcd will alloc memory for hcd, and we should call usb_put_hcd to free it when platform_get_resource() fails to prevent memory leak. goto error2 label instead error1 to fix this.

Scores

CVSS	Score	Vector	Source
3.1	5.5 Medium	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H	CISA-ADP

Weaknesses

CWE-401 Missing Release of Memory after Effective Lifetime

Affected Products

Product	Versions
LinuxLinux	4b7f4a0eb92bf37bea4cd838c7f83ea42823ca8b to before 981ee40649e5fd9550f82db1fbb3bfab037da346Affected a7182993dd8e09f96839ddc3ac54f9b37370d282 to before 84e6d0af87e27bbc0db94f2e7323b34abe17b6e5Affected 8b9c1c33e51d0959f2aec573dfbac0ffd3f5c0b7 to before 6506aff2dc2f7059aa3d45ee2e8639b25e87090fAffected 2754fa3b73df7d0ae042f3ed6cfd9df9042f6262 to before a44a8a762f7fe9ad3c065813d058e835a6180cb2Affected 856e6e8e0f9300befa87dde09edb578555c99a82 to before 701d8ec01e0f229d4db6f43d3d64ee479120cbebAffected 856e6e8e0f9300befa87dde09edb578555c99a82 to before 52bfcedbfd5bf962dbdcb6e761f4d0dd3ba26dfdAffected 856e6e8e0f9300befa87dde09edb578555c99a82 to before 3755278f078460b021cd0384562977bf2039a57aAffected 337f00a0bc62d7cb7d10ec0b872c79009a1641dfAffected 4.14.250 to before 4.14.285Affected 4.19.210 to before 4.19.249Affected 5.4.152 to before 5.4.200Affected 5.10.72 to before 5.10.124Affected 5.14.11 to before 5.15Affected
LinuxLinux	5.15Affected before 5.15Not affected 4.14.285 through 4.14.Not affected 4.19.249 through 4.19.Not affected 5.4.200 through 5.4.Not affected 5.10.124 through 5.10.Not affected 5.15.49 through 5.15.Not affected 5.18.6 through 5.18.Not affected 5.19 and laterNot affected

Product

Versions

LinuxLinux

4b7f4a0eb92bf37bea4cd838c7f83ea42823ca8b to before 981ee40649e5fd9550f82db1fbb3bfab037da346Affected
a7182993dd8e09f96839ddc3ac54f9b37370d282 to before 84e6d0af87e27bbc0db94f2e7323b34abe17b6e5Affected
8b9c1c33e51d0959f2aec573dfbac0ffd3f5c0b7 to before 6506aff2dc2f7059aa3d45ee2e8639b25e87090fAffected
2754fa3b73df7d0ae042f3ed6cfd9df9042f6262 to before a44a8a762f7fe9ad3c065813d058e835a6180cb2Affected
856e6e8e0f9300befa87dde09edb578555c99a82 to before 701d8ec01e0f229d4db6f43d3d64ee479120cbebAffected
856e6e8e0f9300befa87dde09edb578555c99a82 to before 52bfcedbfd5bf962dbdcb6e761f4d0dd3ba26dfdAffected
856e6e8e0f9300befa87dde09edb578555c99a82 to before 3755278f078460b021cd0384562977bf2039a57aAffected
337f00a0bc62d7cb7d10ec0b872c79009a1641dfAffected
4.14.250 to before 4.14.285Affected
4.19.210 to before 4.19.249Affected
5.4.152 to before 5.4.200Affected
5.10.72 to before 5.10.124Affected
5.14.11 to before 5.15Affected

LinuxLinux

5.15Affected
before 5.15Not affected
4.14.285 through 4.14.*Not affected
4.19.249 through 4.19.*Not affected
5.4.200 through 5.4.*Not affected
5.10.124 through 5.10.*Not affected
5.15.49 through 5.15.*Not affected
5.18.6 through 5.18.*Not affected
5.19 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.