CVE-2022-49949

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2022-49949
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-49949.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2022-49949
Downstream
Related
Published
2025-06-18T11:00:13Z
Modified
2025-10-13T21:35:48.202795Z
Summary
firmware_loader: Fix memory leak in firmware upload
Details

In the Linux kernel, the following vulnerability has been resolved:

firmware_loader: Fix memory leak in firmware upload

In the case of firmware-upload, an instance of struct fwupload is allocated in firmwareuploadregister(). This data needs to be freed in fwdevrelease(). Create a new fwuploadfree() function in sysfsupload.c to handle the firmware-upload specific memory frees and incorporate the missing kfree call for the fw_upload structure.

References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
97730bbb242cde22b7140acd202ffd88823886c9
Fixed
baf92485d111be828e1ab84a995515b604b938e5
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
97730bbb242cde22b7140acd202ffd88823886c9
Fixed
789bba82f63c3e81dce426ba457fc7905b30ac6e

Affected versions

v5.*

v5.18
v5.18-rc3
v5.18-rc4
v5.18-rc5
v5.18-rc6
v5.18-rc7
v5.19
v5.19-rc1
v5.19-rc2
v5.19-rc3
v5.19-rc4
v5.19-rc5
v5.19-rc6
v5.19-rc7
v5.19-rc8
v5.19.1
v5.19.2
v5.19.3
v5.19.4
v5.19.5
v5.19.6
v5.19.7

v6.*

v6.0-rc1
v6.0-rc2

Database specific 

{
    "vanir_signatures": [
        {
            "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@789bba82f63c3e81dce426ba457fc7905b30ac6e",
            "deprecated": false,
            "id": "CVE-2022-49949-11ce4f20",
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "78362875545659339795413413865031240964",
                    "254745670711364940560263824276691328185",
                    "199760952162657166320502674094354574760",
                    "63920686314533547761359673660618543595",
                    "19050353959329545877181067494098616621",
                    "199843527643550436045186297019624832190",
                    "277397758689813017298497449065981541224",
                    "167476337368652134161075446064634058831",
                    "242576748092060323334589256775035294345"
                ]
            },
            "signature_version": "v1",
            "signature_type": "Line",
            "target": {
                "file": "drivers/base/firmware_loader/sysfs.h"
            }
        },
        {
            "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@789bba82f63c3e81dce426ba457fc7905b30ac6e",
            "deprecated": false,
            "id": "CVE-2022-49949-555d92d3",
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "108533970758531829684904951963557267064",
                    "336429547211438282551436885460494817819",
                    "210966258273908918904568891838530590913"
                ]
            },
            "signature_version": "v1",
            "signature_type": "Line",
            "target": {
                "file": "drivers/base/firmware_loader/sysfs_upload.c"
            }
        },
        {
            "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@baf92485d111be828e1ab84a995515b604b938e5",
            "deprecated": false,
            "id": "CVE-2022-49949-9520007d",
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "108533970758531829684904951963557267064",
                    "336429547211438282551436885460494817819",
                    "210966258273908918904568891838530590913"
                ]
            },
            "signature_version": "v1",
            "signature_type": "Line",
            "target": {
                "file": "drivers/base/firmware_loader/sysfs_upload.c"
            }
        },
        {
            "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@baf92485d111be828e1ab84a995515b604b938e5",
            "deprecated": false,
            "id": "CVE-2022-49949-ad808ef2",
            "digest": {
                "length": 197.0,
                "function_hash": "288171837032347279508021678806978161682"
            },
            "signature_version": "v1",
            "signature_type": "Function",
            "target": {
                "function": "fw_dev_release",
                "file": "drivers/base/firmware_loader/sysfs.c"
            }
        },
        {
            "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@baf92485d111be828e1ab84a995515b604b938e5",
            "deprecated": false,
            "id": "CVE-2022-49949-b6e3f449",
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "78362875545659339795413413865031240964",
                    "254745670711364940560263824276691328185",
                    "199760952162657166320502674094354574760",
                    "63920686314533547761359673660618543595",
                    "19050353959329545877181067494098616621",
                    "199843527643550436045186297019624832190",
                    "277397758689813017298497449065981541224",
                    "167476337368652134161075446064634058831",
                    "242576748092060323334589256775035294345"
                ]
            },
            "signature_version": "v1",
            "signature_type": "Line",
            "target": {
                "file": "drivers/base/firmware_loader/sysfs.h"
            }
        },
        {
            "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@789bba82f63c3e81dce426ba457fc7905b30ac6e",
            "deprecated": false,
            "id": "CVE-2022-49949-d879929e",
            "digest": {
                "length": 197.0,
                "function_hash": "288171837032347279508021678806978161682"
            },
            "signature_version": "v1",
            "signature_type": "Function",
            "target": {
                "function": "fw_dev_release",
                "file": "drivers/base/firmware_loader/sysfs.c"
            }
        },
        {
            "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@baf92485d111be828e1ab84a995515b604b938e5",
            "deprecated": false,
            "id": "CVE-2022-49949-d8ce2678",
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "34117081694070206516735727059462792851",
                    "163761578487913445663957820767972016812",
                    "297543349551929546024097228753341940598",
                    "212129116870949759294991221326813541372",
                    "313068231139361198227168723711150929653",
                    "89141262593004311502853244750760527090",
                    "48428337420442476152374396035581050628"
                ]
            },
            "signature_version": "v1",
            "signature_type": "Line",
            "target": {
                "file": "drivers/base/firmware_loader/sysfs.c"
            }
        },
        {
            "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@789bba82f63c3e81dce426ba457fc7905b30ac6e",
            "deprecated": false,
            "id": "CVE-2022-49949-f5ef75ce",
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "34117081694070206516735727059462792851",
                    "163761578487913445663957820767972016812",
                    "297543349551929546024097228753341940598",
                    "212129116870949759294991221326813541372",
                    "313068231139361198227168723711150929653",
                    "89141262593004311502853244750760527090",
                    "48428337420442476152374396035581050628"
                ]
            },
            "signature_version": "v1",
            "signature_type": "Line",
            "target": {
                "file": "drivers/base/firmware_loader/sysfs.c"
            }
        }
    ]
}

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
5.19.0
Fixed
5.19.8