PT-2025-18643 · Linux+1 · Linux Kernel+1

Published 2025-05-01 · Updated 2025-05-02 · CVE-2022-49926

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A memory leak issue has been identified in the Linux kernel, specifically in the dsa loop init() function. The kmemleak tool reported 12 new suspected memory leaks. The issue occurs due to two reasons:

1. The fixed phy register() function creates and registers a phy device, but the fixed phy unregister() function only calls phy device remove(), resulting in a memory leak.
2. When mdio driver register() fails in dsa loop init(), it returns without cleaning up the phydevs. The issue is resolved by catching the error of mdio driver register() in dsa loop init() and calling both fixed phy unregister() and phy device free() to release the phydevs. A function is also added for phydevs cleanup to avoid duplication.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Memory Leak

Weakness Enumeration

CWE-401

Related Identifiers

CVE-2022-49926

Affected Products

Astra Linux

Linux Kernel

References · 19

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49926.json · Exploit
• https://git.kernel.org/stable/c/633efc8b3dc96f56f5a57f2a49764853a2fa3f50 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-49926 · Vendor Advisory
• https://git.kernel.org/stable/c/4d2024b138d9f7b02ae13ee997fd3a71e9e46254 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-49926 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2022-49926 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-49926 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-49926 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-49926 · Security Note
• https://git.kernel.org/stable/c/9f555b1584fc2d5d16ee3c4d9438e93ac7c502c7 · Patch
• https://git.kernel.org/stable/c/d593e1ede655b74c42e4e4fe285ea64aee96fb5c · Patch
• https://git.kernel.org/stable/c/935b4beb724946a37cebf97191592d4879d3a3a3 · Patch
• https://git.kernel.org/stable/c/37a098fc9b42bd7fce66764866aa514639667b6e · Patch
• https://osv.dev/vulnerability/CVE-2022-49926 · Vendor Advisory
• https://git.kernel.org/stable/c/bbc5d7b46a729bfcbb5544f6612b7a67dd4f4d6f · Patch