CVE-2022-49128

drm/bridge: Add missing pm_runtime_put_sync

Description

In the Linux kernel, the following vulnerability has been resolved: drm/bridge: Add missing pm_runtime_put_sync pm_runtime_get_sync() will increase the rumtime PM counter even when it returns an error. Thus a pairing decrement is needed to prevent refcount leak. Fix this by replacing this API with pm_runtime_resume_and_get(), which will not change the runtime PM counter on error. Besides, a matching decrement is needed on the error handling path to keep the counter balanced.

5.5

CVSS

Severity: Medium

CVSS 3.1 •

EPSS 0.02%

Affected: Linux Linux

References

Link	Tags
https://git.kernel.org/stable/c/ff13c90d7f7ab606b37be6d15140d19013d6736c	patch
https://git.kernel.org/stable/c/792533e54cd6e89191798ccd1abd590c62b9077e	patch
https://git.kernel.org/stable/c/9df80dc738926a2ea4bd1ce5993c3d0f4b0e855c	patch
https://git.kernel.org/stable/c/46f47807738441e354873546dde0b000106c068a	patch

Frequently Asked Questions

What is the severity of CVE-2022-49128?: CVE-2022-49128 has been scored as a medium severity vulnerability.
How to fix CVE-2022-49128?: To fix CVE-2022-49128, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2022-49128 being actively exploited in the wild?: As for now, there are no information to confirm that CVE-2022-49128 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2022-49128?: CVE-2022-49128 affects Linux Linux, Linux Linux.

This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.