CVE-2022-49949

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2022-49949
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-49949.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2022-49949
Downstream
Related
Published
2025-06-18T11:00:13.277Z
Modified
2025-11-28T05:40:34.622705Z
Summary
firmware_loader: Fix memory leak in firmware upload
Details

In the Linux kernel, the following vulnerability has been resolved:

firmware_loader: Fix memory leak in firmware upload

In the case of firmware-upload, an instance of struct fwupload is allocated in firmwareuploadregister(). This data needs to be freed in fwdevrelease(). Create a new fwuploadfree() function in sysfsupload.c to handle the firmware-upload specific memory frees and incorporate the missing kfree call for the fw_upload structure.

Database specific 
{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49949.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
97730bbb242cde22b7140acd202ffd88823886c9
Fixed
baf92485d111be828e1ab84a995515b604b938e5
Fixed
789bba82f63c3e81dce426ba457fc7905b30ac6e

Affected versions

v5.*

v5.18
v5.18-rc3
v5.18-rc4
v5.18-rc5
v5.18-rc6
v5.18-rc7
v5.19
v5.19-rc1
v5.19-rc2
v5.19-rc3
v5.19-rc4
v5.19-rc5
v5.19-rc6
v5.19-rc7
v5.19-rc8
v5.19.1
v5.19.2
v5.19.3
v5.19.4
v5.19.5
v5.19.6
v5.19.7

v6.*

v6.0-rc1
v6.0-rc2

Database specific

vanir_signatures

[
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@789bba82f63c3e81dce426ba457fc7905b30ac6e",
        "signature_type": "Line",
        "digest": {
            "line_hashes": [
                "78362875545659339795413413865031240964",
                "254745670711364940560263824276691328185",
                "199760952162657166320502674094354574760",
                "63920686314533547761359673660618543595",
                "19050353959329545877181067494098616621",
                "199843527643550436045186297019624832190",
                "277397758689813017298497449065981541224",
                "167476337368652134161075446064634058831",
                "242576748092060323334589256775035294345"
            ],
            "threshold": 0.9
        },
        "deprecated": false,
        "target": {
            "file": "drivers/base/firmware_loader/sysfs.h"
        },
        "id": "CVE-2022-49949-11ce4f20",
        "signature_version": "v1"
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@789bba82f63c3e81dce426ba457fc7905b30ac6e",
        "signature_type": "Line",
        "digest": {
            "line_hashes": [
                "108533970758531829684904951963557267064",
                "336429547211438282551436885460494817819",
                "210966258273908918904568891838530590913"
            ],
            "threshold": 0.9
        },
        "deprecated": false,
        "target": {
            "file": "drivers/base/firmware_loader/sysfs_upload.c"
        },
        "id": "CVE-2022-49949-555d92d3",
        "signature_version": "v1"
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@baf92485d111be828e1ab84a995515b604b938e5",
        "signature_type": "Line",
        "digest": {
            "line_hashes": [
                "108533970758531829684904951963557267064",
                "336429547211438282551436885460494817819",
                "210966258273908918904568891838530590913"
            ],
            "threshold": 0.9
        },
        "deprecated": false,
        "target": {
            "file": "drivers/base/firmware_loader/sysfs_upload.c"
        },
        "id": "CVE-2022-49949-9520007d",
        "signature_version": "v1"
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@baf92485d111be828e1ab84a995515b604b938e5",
        "signature_type": "Function",
        "digest": {
            "length": 197.0,
            "function_hash": "288171837032347279508021678806978161682"
        },
        "deprecated": false,
        "target": {
            "file": "drivers/base/firmware_loader/sysfs.c",
            "function": "fw_dev_release"
        },
        "id": "CVE-2022-49949-ad808ef2",
        "signature_version": "v1"
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@baf92485d111be828e1ab84a995515b604b938e5",
        "signature_type": "Line",
        "digest": {
            "line_hashes": [
                "78362875545659339795413413865031240964",
                "254745670711364940560263824276691328185",
                "199760952162657166320502674094354574760",
                "63920686314533547761359673660618543595",
                "19050353959329545877181067494098616621",
                "199843527643550436045186297019624832190",
                "277397758689813017298497449065981541224",
                "167476337368652134161075446064634058831",
                "242576748092060323334589256775035294345"
            ],
            "threshold": 0.9
        },
        "deprecated": false,
        "target": {
            "file": "drivers/base/firmware_loader/sysfs.h"
        },
        "id": "CVE-2022-49949-b6e3f449",
        "signature_version": "v1"
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@789bba82f63c3e81dce426ba457fc7905b30ac6e",
        "signature_type": "Function",
        "digest": {
            "length": 197.0,
            "function_hash": "288171837032347279508021678806978161682"
        },
        "deprecated": false,
        "target": {
            "file": "drivers/base/firmware_loader/sysfs.c",
            "function": "fw_dev_release"
        },
        "id": "CVE-2022-49949-d879929e",
        "signature_version": "v1"
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@baf92485d111be828e1ab84a995515b604b938e5",
        "signature_type": "Line",
        "digest": {
            "line_hashes": [
                "34117081694070206516735727059462792851",
                "163761578487913445663957820767972016812",
                "297543349551929546024097228753341940598",
                "212129116870949759294991221326813541372",
                "313068231139361198227168723711150929653",
                "89141262593004311502853244750760527090",
                "48428337420442476152374396035581050628"
            ],
            "threshold": 0.9
        },
        "deprecated": false,
        "target": {
            "file": "drivers/base/firmware_loader/sysfs.c"
        },
        "id": "CVE-2022-49949-d8ce2678",
        "signature_version": "v1"
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@789bba82f63c3e81dce426ba457fc7905b30ac6e",
        "signature_type": "Line",
        "digest": {
            "line_hashes": [
                "34117081694070206516735727059462792851",
                "163761578487913445663957820767972016812",
                "297543349551929546024097228753341940598",
                "212129116870949759294991221326813541372",
                "313068231139361198227168723711150929653",
                "89141262593004311502853244750760527090",
                "48428337420442476152374396035581050628"
            ],
            "threshold": 0.9
        },
        "deprecated": false,
        "target": {
            "file": "drivers/base/firmware_loader/sysfs.c"
        },
        "id": "CVE-2022-49949-f5ef75ce",
        "signature_version": "v1"
    }
]

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
5.19.0
Fixed
5.19.8