CVE-2022-49922

nfc: nfcmrvl: Fix potential memory leak in nfcmrvl_i2c_nci_send()

State: Published
Severity: 5.5 Medium
Published: May 1, 2025
Updated: May 11, 2026
Reserved: May 1, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

nfc: nfcmrvl: Fix potential memory leak in nfcmrvl_i2c_nci_send()

nfcmrvl_i2c_nci_send() will be called by nfcmrvl_nci_send(), and skb should be freed in nfcmrvl_i2c_nci_send(). However, nfcmrvl_nci_send() will only free skb when i2c_master_send() return >=0, which means skb will memleak when i2c_master_send() failed. Free skb no matter whether i2c_master_send() succeeds.

Scores

CVSS	Score	Vector	Source
3.1	5.5 Medium	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H	CISA-ADP

Weaknesses

CWE-401 Missing Release of Memory after Effective Lifetime

Affected Products

Product	Versions
LinuxLinux	b5b3e23e4cace008e1a30e8614a484d14dfd07a1 to before dd0ee55ead91fbb16889dbe7ff0b0f7c9e4e849dAffected b5b3e23e4cace008e1a30e8614a484d14dfd07a1 to before 825656ae61e73ddc05f585e6258d284c87064b10Affected b5b3e23e4cace008e1a30e8614a484d14dfd07a1 to before c8e7d4a1166f063703955f1b2e765a6db5bf1771Affected b5b3e23e4cace008e1a30e8614a484d14dfd07a1 to before f30060efcf18883748a0541aa41acef183cd9c0eAffected b5b3e23e4cace008e1a30e8614a484d14dfd07a1 to before 52438e734c1566f5e2bcd9a065d2d65e306c0555Affected b5b3e23e4cace008e1a30e8614a484d14dfd07a1 to before 5dfdac5e3f8db5f4445228c44f64091045644a3bAffected b5b3e23e4cace008e1a30e8614a484d14dfd07a1 to before 92a1df9c6da20c02cf9872f8b025a66ddb307aebAffected b5b3e23e4cace008e1a30e8614a484d14dfd07a1 to before 93d904a734a74c54d945a9884b4962977f1176cdAffected
LinuxLinux	4.4Affected before 4.4Not affected 4.9.333 through 4.9.Not affected 4.14.299 through 4.14.Not affected 4.19.265 through 4.19.Not affected 5.4.224 through 5.4.Not affected 5.10.154 through 5.10.Not affected 5.15.78 through 5.15.Not affected 6.0.8 through 6.0.*Not affected 6.1 and laterNot affected

Product

Versions

LinuxLinux

b5b3e23e4cace008e1a30e8614a484d14dfd07a1 to before dd0ee55ead91fbb16889dbe7ff0b0f7c9e4e849dAffected
b5b3e23e4cace008e1a30e8614a484d14dfd07a1 to before 825656ae61e73ddc05f585e6258d284c87064b10Affected
b5b3e23e4cace008e1a30e8614a484d14dfd07a1 to before c8e7d4a1166f063703955f1b2e765a6db5bf1771Affected
b5b3e23e4cace008e1a30e8614a484d14dfd07a1 to before f30060efcf18883748a0541aa41acef183cd9c0eAffected
b5b3e23e4cace008e1a30e8614a484d14dfd07a1 to before 52438e734c1566f5e2bcd9a065d2d65e306c0555Affected
b5b3e23e4cace008e1a30e8614a484d14dfd07a1 to before 5dfdac5e3f8db5f4445228c44f64091045644a3bAffected
b5b3e23e4cace008e1a30e8614a484d14dfd07a1 to before 92a1df9c6da20c02cf9872f8b025a66ddb307aebAffected
b5b3e23e4cace008e1a30e8614a484d14dfd07a1 to before 93d904a734a74c54d945a9884b4962977f1176cdAffected

LinuxLinux

4.4Affected
before 4.4Not affected
4.9.333 through 4.9.*Not affected
4.14.299 through 4.14.*Not affected
4.19.265 through 4.19.*Not affected
5.4.224 through 5.4.*Not affected
5.10.154 through 5.10.*Not affected
5.15.78 through 5.15.*Not affected
6.0.8 through 6.0.*Not affected
6.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.