PT-2025-8441 · Linux+2 · Linux Kernel+2

Miaoqian Lin · Published 2025-02-26 · Updated 2025-04-15 · CVE-2022-49508

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A potential double free issue in the elan input configured function of the Linux kernel's HID (Human Interface Device) elan driver has been resolved. The issue arises because the input resource, allocated with devm input allocate device(), is freed explicitly with input free device(), leading to a double free. According to the documentation of devm input allocate device(), managed input devices are automatically unregistered and freed when the owner device unbinds from its driver, making explicit unregistration or freeing unnecessary.

Recommendations For the affected Linux kernel versions, consider updating to a version that includes the fix for the double free issue in the elan input configured function. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Double Free

Weakness Enumeration

CWE-415

Related Identifiers

CVE-2022-49508

OESA-2025-1336

OPENSUSE-SU-2025_1263-1

SUSE-SU-2025:1027-1

SUSE-SU-2025:1176-1

SUSE-SU-2025:1183-1

SUSE-SU-2025:1194-1

SUSE-SU-2025:1241-1

SUSE-SU-2025:1263-1

SUSE-SU-2025_1027-1

SUSE-SU-2025_1241-1

SUSE-SU-2025_1263-1

Affected Products

Astra Linux

Linux Kernel

Suse

References · 1364

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49508.json · Exploit
• https://osv.dev/vulnerability/SUSE-SU-2025:1263-1 · Vendor Advisory
• https://git.kernel.org/stable/c/24f9dfdaece9bd75bb8dbfdba83eddeefdf7dc47 · Patch
• https://osv.dev/vulnerability/SUSE-SU-2025:1027-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-49508 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-49292 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-49508 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-49625 · Security Note
• https://osv.dev/vulnerability/CVE-2022-49508 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-49381 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-47659 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-49535 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2025:1241-1 · Vendor Advisory
• https://git.kernel.org/stable/c/8bb1716507ebf12d50bbf181764481de3b6bc7fd · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-49243 · Security Note