CVE-2022-49787
mmc: sdhci-pci: Fix possible memory leak caused by missing pci_dev_put()
MEDIUM 5.5
At a glance
- Source
- NVD
- EPSS
- EPSS 0.22 % · percentile 12 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- Linux
- NVD status
- Analyzed
Description
In the Linux kernel, the following vulnerability has been resolved: mmc: sdhci-pci: Fix possible memory leak caused by missing pci_dev_put() pci_get_device() will increase the reference count for the returned pci_dev. We need to use pci_dev_put() to decrease the reference count before amd_probe() returns. There is no problem for the 'smbus_dev == NULL' branch because pci_dev_put() can also handle the NULL input parameter case.
Weaknesses (CWE)
- CWE-401 — Missing Release of Memory after Effective Lifetime
References
- https://git.kernel.org/stable/c/7570e5b5419ffd34b6dc45a88c51e113a9a187e3
- https://git.kernel.org/stable/c/5dbd6378dbf96787d6dbcca44156c511ae085ea3
- https://git.kernel.org/stable/c/27f712cd47d65e14cd52cc32a23d42aeef583d5d
- https://git.kernel.org/stable/c/4423866d31a06a810db22062ed13389416a66b22
- https://git.kernel.org/stable/c/a99a547658e5d451f01ed307426286716b6f01bf
- https://git.kernel.org/stable/c/35bca18092685b488003509fef7055aa2d4f2ebc
- https://git.kernel.org/stable/c/222cfa0118aa68687ace74aab8fdf77ce8fbd7e6
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2025-12978
- GCVE · GCVE-0-2022-49787
CERT-FR advisories
- CERTFR-2026-AVI-0081 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2025-AVI-1009 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0587 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0560 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0529 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0509 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 4.4 < 4.14.300cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 4.15 < 4.19.267cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 4.20 < 5.4.225cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.5 < 5.10.156cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.11 < 5.15.80cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.16 < 6.0.10cpe:2.3:o:linux:linux_kernel:6.1:rc1:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:6.1:rc2:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:6.1:rc3:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:6.1:rc4:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:6.1:rc5:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| Linux · Linux | affected 659c9bc114a810b3a3c1e50585cc57f1312a6d60 < 7570e5b5419ffd34b6dc45a88c51e113a9a187e3 ; affected 659c9bc114a810b3a3c1e50585cc57f1312a6d60 < 5dbd6378dbf96787d6dbcca44156c511ae085ea3 ; affected 659c9bc114a810b3a3c1e50585cc57f1312a6d60 < 27f712cd47d65e14cd52cc32a23d42aeef583d5d ; affected 659c9bc114a810b3a3c1e50585cc57f1312a6d60 < 4423866d31a06a810db22062ed13389416a66b22 ; affected 659c9bc114a810b3a3c1e50585cc57f1312a6d60 < a99a547658e5d451f01ed307426286716b6f01bf ; affected 659c9bc114a810b3a3c1e50585cc57f1312a6d60 < 35bca18092685b488003509fef7055aa2d4f2ebc |
| Linux · Linux | affected 4.4 ; unaffected 0 < 4.4 ; unaffected 4.14.300 ≤ 4.14.* ; unaffected 4.19.267 ≤ 4.19.* ; unaffected 5.4.225 ≤ 5.4.* ; unaffected 5.10.156 ≤ 5.10.* |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |