PT-2025-13294 · Linux+4 · Linux Kernel+4

Published 2023-11-07 · Updated 2025-05-29 · CVE-2022-49752

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A node refcount leak issue has been identified in the function fwnode graph get next endpoint(). This occurs because the parent returned by fwnode graph get port parent() has its refcount incremented when prev is not NULL, and it needs to be put when finished using it. To address this, a new variable is introduced to store the returned fwnode, which is then put before returning from fwnode graph get next endpoint().

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Memory Leak

Weakness Enumeration

CWE-401

Related Identifiers

BDU:2025-06298

CESA-2023_7077

CVE-2022-49752

RHSA-2023:6583

RHSA-2023:7077

RHSA-2023_6583

RHSA-2023_7077

Affected Products

Astra Linux

Centos

Linux Kernel

Red Hat

Red Os

References · 20

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49752.json · Exploit
• https://cve.org/CVERecord?id=CVE-2022-49752 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-49752 · Security Note
• https://ubuntu.com/security/CVE-2022-49752 · Vendor Advisory
• https://git.kernel.org/stable/c/e75485fc589ec729cc182aa9b41dfb6c15ae6f6e · Patch
• https://osv.dev/vulnerability/CVE-2022-49752 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-49752 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-06298 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-49752 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-49752 · Vendor Advisory
• https://git.kernel.org/stable/c/7701a4bd45c11f9a289d8f262fad05705a012339 · Patch
• https://git.kernel.org/stable/c/39af728649b05e88a2b40e714feeee6451c3f18e · Patch
• https://git.kernel.org/linus/39af728649b05e88a2b40e714feeee6451c3f18e · Note
• https://lore.kernel.org/linux-cve-announce/2025032700-CVE-2022-49752-19a3@gregkh/T · Note
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/mnozhestvennye-uyazvimosti-kernel-lt-290525 · Note