PT-2025-13283 · Linux+3 · Linux Kernel+3

Published 2025-03-27 · Updated 2025-05-29 · CVE-2022-49741

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A memory leak bug has been identified in the Linux kernel, specifically in the ufx usb probe function. The error handling code in this function has several issues, including missing ufx free usb list and incorrect matching of fb alloc cmap and fb dealloc cmap. This bug can cause a memory leak, as reported by syzkaller. The leak occurs when the kmalloc trace function is called, leading to an unreferenced object.

Recommendations To resolve this issue, the error handling code in ufx usb probe should be rewritten to fix the memory leak bug. This can be achieved by properly handling the allocation and deallocation of memory in the ufx usb probe function, ensuring that all allocated memory is properly freed in case of an error.

At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Memory Leak

Weakness Enumeration

CWE-401

Related Identifiers

BDU:2025-06293

CVE-2022-49741

OPENSUSE-SU-2025_01620-1

OPENSUSE-SU-2025_01627-1

OPENSUSE-SU-2025_01640-1

SUSE-SU-2025:01620-1

SUSE-SU-2025:01627-1

SUSE-SU-2025:01640-1

SUSE-SU-2025:1573-1

SUSE-SU-2025_01620-1

SUSE-SU-2025_01627-1

Affected Products

Astra Linux

Linux Kernel

Red Os

Suse

References · 124

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49741.json · Exploit
• https://git.kernel.org/stable/c/64fa364ad3245508d393e16ed4886f92d7eb423c · Patch
• https://osv.dev/vulnerability/SUSE-SU-2025:01640-1 · Vendor Advisory
• https://git.kernel.org/stable/c/b76449ee75e21acfe9fa4c653d8598f191ed7d68 · Patch
• https://osv.dev/vulnerability/CVE-2022-49741 · Vendor Advisory
• https://git.kernel.org/stable/c/1b4c08844628dfc8d72d3f51b657f2a5e63b7b4b · Patch
• https://osv.dev/vulnerability/SUSE-SU-2025:1573-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:01620-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-49741 · Security Note
• https://bdu.fstec.ru/vul/2025-06293 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2022-49741 · Vendor Advisory
• https://git.kernel.org/stable/c/3b3d3127f5b4291ae4caaf50f7b66089ad600480 · Patch
• https://osv.dev/vulnerability/SUSE-SU-2025:01627-1 · Vendor Advisory
• https://git.kernel.org/stable/c/3931014367ef31d26af65386a4ca496f50f0cfdf · Patch
• https://cve.org/CVERecord?id=CVE-2022-49741 · Security Note