CVE-2022-49619

net: sfp: fix memory leak in sfp_probe()

Description

In the Linux kernel, the following vulnerability has been resolved: net: sfp: fix memory leak in sfp_probe() sfp_probe() allocates a memory chunk from sfp with sfp_alloc(). When devm_add_action() fails, sfp is not freed, which leads to a memory leak. We should use devm_add_action_or_reset() instead of devm_add_action().

Category

5.5
CVSS
Severity: Medium
CVSS 3.1 •
EPSS 0.02%
Affected: Linux Linux
Affected: Linux Linux
Published at:
Updated at:

References

Link Tags
https://git.kernel.org/stable/c/9ec5a97f327a89031fce6cfc3e95543c53936638 patch
https://git.kernel.org/stable/c/1545bc727625ea6e8decd717e5d1e8cc704ccf8f patch
https://git.kernel.org/stable/c/ede990cfc42775bd0141e21f37ee365dcaeeb50f patch
https://git.kernel.org/stable/c/67dc32542a1fb7790d0853cf4a5cf859ac6a2002 patch
https://git.kernel.org/stable/c/204543581a2f26bb3b997a304c0bd06926ba7f15 patch
https://git.kernel.org/stable/c/f22ddc8a5278d7fb6369a0aeb0d8775a0aefaaee patch
https://git.kernel.org/stable/c/0a18d802d65cf662644fd1d369c86d84a5630652 patch

Frequently Asked Questions

What is the severity of CVE-2022-49619?
CVE-2022-49619 has been scored as a medium severity vulnerability.
How to fix CVE-2022-49619?
To fix CVE-2022-49619, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2022-49619 being actively exploited in the wild?
As for now, there are no information to confirm that CVE-2022-49619 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2022-49619?
CVE-2022-49619 affects Linux Linux, Linux Linux.
This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.
© 2025 Under My Watch. All Rights Reserved.