PT-2025-25922 · Linux+1 · Linux Kernel+1

Published 2022-08-15 · Updated 2025-06-19 · CVE-2022-49996

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A memory leak issue has been identified in the Linux kernel, specifically in the btrfs get dev args from path() function. This function can fail if the provided path is invalid, leading to a memory leak because the previously allocated memory for args->uuid and args->fsid is not freed. The issue is resolved by calling btrfs put dev args from path() to clean up the memory when btrfs get bdev and sb() fails.

Recommendations To resolve the issue, update the Linux kernel to a version that includes the fix for the memory leak in btrfs get dev args from path(). At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Memory Leak

Weakness Enumeration

CWE-401

Related Identifiers

BDU:2026-03134

CVE-2022-49996

Affected Products

Astra Linux

Linux Kernel

References · 17

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49996.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-49996 · Security Note
• https://ubuntu.com/security/CVE-2022-49996 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-03134 · Security Note
• https://git.kernel.org/stable/c/9ea0106a7a3d8116860712e3f17cd52ce99f6707 · Patch
• https://git.kernel.org/stable/c/4b124ad87244cd7f0883c5eaa38d2326b2154cad · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-49996 · Vendor Advisory
• https://git.kernel.org/stable/c/5f52402c77013e4a826394b807dd5ea4dc83bd72 · Patch
• https://cve.org/CVERecord?id=CVE-2022-49996 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2022-49996 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-49996 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-49996 · Vendor Advisory
• https://lore.kernel.org/linux-cve-announce/2025061826-CVE-2022-49996-71e2@gregkh · Note
• https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git · Note
• https://kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.19.6 · Note