{"id":"CVE-2022-49741","state":"PUBLISHED","title":"fbdev: smscufx: fix error handling code in ufx_usb_probe","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: smscufx: fix error handling code in ufx_usb_probe\n\nThe current error handling code in ufx_usb_probe have many unmatching\nissues, e.g., missing ufx_free_usb_list, destroy_modedb label should\nonly include framebuffer_release, fb_dealloc_cmap only matches\nfb_alloc_cmap.\n\nMy local syzkaller reports a memory leak bug:\n\nmemory leak in ufx_usb_probe\n\nBUG: memory leak\nunreferenced object 0xffff88802f879580 (size 128):\n  comm \"kworker/0:7\", pid 17416, jiffies 4295067474 (age 46.710s)\n  hex dump (first 32 bytes):\n    80 21 7c 2e 80 88 ff ff 18 d0 d0 0c 80 88 ff ff  .!|.............\n    00 d0 d0 0c 80 88 ff ff e0 ff ff ff 0f 00 00 00  ................\n  backtrace:\n    [<ffffffff814c99a0>] kmalloc_trace+0x20/0x90 mm/slab_common.c:1045\n    [<ffffffff824d219c>] kmalloc include/linux/slab.h:553 [inline]\n    [<ffffffff824d219c>] kzalloc include/linux/slab.h:689 [inline]\n    [<ffffffff824d219c>] ufx_alloc_urb_list drivers/video/fbdev/smscufx.c:1873 [inline]\n    [<ffffffff824d219c>] ufx_usb_probe+0x11c/0x15a0 drivers/video/fbdev/smscufx.c:1655\n    [<ffffffff82d17927>] usb_probe_interface+0x177/0x370 drivers/usb/core/driver.c:396\n    [<ffffffff82712f0d>] call_driver_probe drivers/base/dd.c:560 [inline]\n    [<ffffffff82712f0d>] really_probe+0x12d/0x390 drivers/base/dd.c:639\n    [<ffffffff8271322f>] __driver_probe_device+0xbf/0x140 drivers/base/dd.c:778\n    [<ffffffff827132da>] driver_probe_device+0x2a/0x120 drivers/base/dd.c:808\n    [<ffffffff82713c27>] __device_attach_driver+0xf7/0x150 drivers/base/dd.c:936\n    [<ffffffff82710137>] bus_for_each_drv+0xb7/0x100 drivers/base/bus.c:427\n    [<ffffffff827136b5>] __device_attach+0x105/0x2d0 drivers/base/dd.c:1008\n    [<ffffffff82711d36>] bus_probe_device+0xc6/0xe0 drivers/base/bus.c:487\n    [<ffffffff8270e242>] device_add+0x642/0xdc0 drivers/base/core.c:3517\n    [<ffffffff82d14d5f>] usb_set_configuration+0x8ef/0xb80 drivers/usb/core/message.c:2170\n    [<ffffffff82d2576c>] usb_generic_driver_probe+0x8c/0xc0 drivers/usb/core/generic.c:238\n    [<ffffffff82d16ffc>] usb_probe_device+0x5c/0x140 drivers/usb/core/driver.c:293\n    [<ffffffff82712f0d>] call_driver_probe drivers/base/dd.c:560 [inline]\n    [<ffffffff82712f0d>] really_probe+0x12d/0x390 drivers/base/dd.c:639\n    [<ffffffff8271322f>] __driver_probe_device+0xbf/0x140 drivers/base/dd.c:778\n\nFix this bug by rewriting the error handling code in ufx_usb_probe.","publishedAt":"2025-03-27T16:42:52.994Z","updatedAt":"2026-05-23T15:22:49.418Z","severity":{"score":5.5,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","source":"CISA-ADP"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"5385af2f89bc352fb70753ab41b2bb036190141f","status":"affected","lessThan":"3b3d3127f5b4291ae4caaf50f7b66089ad600480","versionType":"git"},{"version":"d9ddfeb01fb95ffbbc7031d46a5ee2a5e45cbb86","status":"affected","lessThan":"3931014367ef31d26af65386a4ca496f50f0cfdf","versionType":"git"},{"version":"cc6a7249842fceda7574ceb63275a2d5e99d2862","status":"affected","lessThan":"64fa364ad3245508d393e16ed4886f92d7eb423c","versionType":"git"},{"version":"cc67482c9e5f2c80d62f623bcc347c29f9f648e1","status":"affected","lessThan":"1b4c08844628dfc8d72d3f51b657f2a5e63b7b4b","versionType":"git"},{"version":"cc67482c9e5f2c80d62f623bcc347c29f9f648e1","status":"affected","lessThan":"b76449ee75e21acfe9fa4c653d8598f191ed7d68","versionType":"git"},{"version":"6f2075ea883e5d7730d0c9ebb1bb8e7a1a7e953f","status":"affected","versionType":"git"},{"version":"3f40852d671072836fb7ae331a1f28a24223c4e8","status":"affected","versionType":"git"},{"version":"70faf9d9b6cc74418716bbf76fe75bd2da10ad4a","status":"affected","versionType":"git"},{"version":"8d924b262f3178a9b17c17d4306a9f426c508bd9","status":"affected","versionType":"git"},{"version":"5.4.223","status":"affected","lessThan":"5.4.232","versionType":"semver"},{"version":"5.10.153","status":"affected","lessThan":"5.10.168","versionType":"semver"},{"version":"5.15.77","status":"affected","lessThan":"5.15.93","versionType":"semver"},{"version":"4.9.332","status":"affected","lessThan":"4.10","versionType":"semver"},{"version":"4.14.298","status":"affected","lessThan":"4.15","versionType":"semver"},{"version":"4.19.264","status":"affected","lessThan":"4.20","versionType":"semver"},{"version":"6.0.7","status":"affected","lessThan":"6.1","versionType":"semver"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/video/fbdev/smscufx.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.1","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.1","versionType":"semver"},{"version":"5.4.232","status":"unaffected","lessThanOrEqual":"5.4.*","versionType":"semver"},{"version":"5.10.168","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.93","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.11","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/video/fbdev/smscufx.c"]}],"references":["https://git.kernel.org/stable/c/3b3d3127f5b4291ae4caaf50f7b66089ad600480","https://git.kernel.org/stable/c/3931014367ef31d26af65386a4ca496f50f0cfdf","https://git.kernel.org/stable/c/64fa364ad3245508d393e16ed4886f92d7eb423c","https://git.kernel.org/stable/c/1b4c08844628dfc8d72d3f51b657f2a5e63b7b4b","https://git.kernel.org/stable/c/b76449ee75e21acfe9fa4c653d8598f191ed7d68"],"weaknesses":["CWE-401"],"ingestedAt":"2026-10-29T20:05:26.763Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2022/49xxx/CVE-2022-49741.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2022-49741","state":"PUBLISHED","datePublished":"2025-03-27T16:42:52.994Z","dateUpdated":"2026-05-23T15:22:49.418Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2025-03-27T16:39:17.986Z"},"containers":{"cna":{"title":"fbdev: smscufx: fix error handling code in ufx_usb_probe","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: smscufx: fix error handling code in ufx_usb_probe\n\nThe current error handling code in ufx_usb_probe have many unmatching\nissues, e.g., missing ufx_free_usb_list, destroy_modedb label should\nonly include framebuffer_release, fb_dealloc_cmap only matches\nfb_alloc_cmap.\n\nMy local syzkaller reports a memory leak bug:\n\nmemory leak in ufx_usb_probe\n\nBUG: memory leak\nunreferenced object 0xffff88802f879580 (size 128):\n  comm \"kworker/0:7\", pid 17416, jiffies 4295067474 (age 46.710s)\n  hex dump (first 32 bytes):\n    80 21 7c 2e 80 88 ff ff 18 d0 d0 0c 80 88 ff ff  .!|.............\n    00 d0 d0 0c 80 88 ff ff e0 ff ff ff 0f 00 00 00  ................\n  backtrace:\n    [<ffffffff814c99a0>] kmalloc_trace+0x20/0x90 mm/slab_common.c:1045\n    [<ffffffff824d219c>] kmalloc include/linux/slab.h:553 [inline]\n    [<ffffffff824d219c>] kzalloc include/linux/slab.h:689 [inline]\n    [<ffffffff824d219c>] ufx_alloc_urb_list drivers/video/fbdev/smscufx.c:1873 [inline]\n    [<ffffffff824d219c>] ufx_usb_probe+0x11c/0x15a0 drivers/video/fbdev/smscufx.c:1655\n    [<ffffffff82d17927>] usb_probe_interface+0x177/0x370 drivers/usb/core/driver.c:396\n    [<ffffffff82712f0d>] call_driver_probe drivers/base/dd.c:560 [inline]\n    [<ffffffff82712f0d>] really_probe+0x12d/0x390 drivers/base/dd.c:639\n    [<ffffffff8271322f>] __driver_probe_device+0xbf/0x140 drivers/base/dd.c:778\n    [<ffffffff827132da>] driver_probe_device+0x2a/0x120 drivers/base/dd.c:808\n    [<ffffffff82713c27>] __device_attach_driver+0xf7/0x150 drivers/base/dd.c:936\n    [<ffffffff82710137>] bus_for_each_drv+0xb7/0x100 drivers/base/bus.c:427\n    [<ffffffff827136b5>] __device_attach+0x105/0x2d0 drivers/base/dd.c:1008\n    [<ffffffff82711d36>] bus_probe_device+0xc6/0xe0 drivers/base/bus.c:487\n    [<ffffffff8270e242>] device_add+0x642/0xdc0 drivers/base/core.c:3517\n    [<ffffffff82d14d5f>] usb_set_configuration+0x8ef/0xb80 drivers/usb/core/message.c:2170\n    [<ffffffff82d2576c>] usb_generic_driver_probe+0x8c/0xc0 drivers/usb/core/generic.c:238\n    [<ffffffff82d16ffc>] usb_probe_device+0x5c/0x140 drivers/usb/core/driver.c:293\n    [<ffffffff82712f0d>] call_driver_probe drivers/base/dd.c:560 [inline]\n    [<ffffffff82712f0d>] really_probe+0x12d/0x390 drivers/base/dd.c:639\n    [<ffffffff8271322f>] __driver_probe_device+0xbf/0x140 drivers/base/dd.c:778\n\nFix this bug by rewriting the error handling code in ufx_usb_probe."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"5385af2f89bc352fb70753ab41b2bb036190141f","status":"affected","lessThan":"3b3d3127f5b4291ae4caaf50f7b66089ad600480","versionType":"git"},{"version":"d9ddfeb01fb95ffbbc7031d46a5ee2a5e45cbb86","status":"affected","lessThan":"3931014367ef31d26af65386a4ca496f50f0cfdf","versionType":"git"},{"version":"cc6a7249842fceda7574ceb63275a2d5e99d2862","status":"affected","lessThan":"64fa364ad3245508d393e16ed4886f92d7eb423c","versionType":"git"},{"version":"cc67482c9e5f2c80d62f623bcc347c29f9f648e1","status":"affected","lessThan":"1b4c08844628dfc8d72d3f51b657f2a5e63b7b4b","versionType":"git"},{"version":"cc67482c9e5f2c80d62f623bcc347c29f9f648e1","status":"affected","lessThan":"b76449ee75e21acfe9fa4c653d8598f191ed7d68","versionType":"git"},{"version":"6f2075ea883e5d7730d0c9ebb1bb8e7a1a7e953f","status":"affected","versionType":"git"},{"version":"3f40852d671072836fb7ae331a1f28a24223c4e8","status":"affected","versionType":"git"},{"version":"70faf9d9b6cc74418716bbf76fe75bd2da10ad4a","status":"affected","versionType":"git"},{"version":"8d924b262f3178a9b17c17d4306a9f426c508bd9","status":"affected","versionType":"git"},{"version":"5.4.223","status":"affected","lessThan":"5.4.232","versionType":"semver"},{"version":"5.10.153","status":"affected","lessThan":"5.10.168","versionType":"semver"},{"version":"5.15.77","status":"affected","lessThan":"5.15.93","versionType":"semver"},{"version":"4.9.332","status":"affected","lessThan":"4.10","versionType":"semver"},{"version":"4.14.298","status":"affected","lessThan":"4.15","versionType":"semver"},{"version":"4.19.264","status":"affected","lessThan":"4.20","versionType":"semver"},{"version":"6.0.7","status":"affected","lessThan":"6.1","versionType":"semver"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/video/fbdev/smscufx.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.1","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.1","versionType":"semver"},{"version":"5.4.232","status":"unaffected","lessThanOrEqual":"5.4.*","versionType":"semver"},{"version":"5.10.168","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.93","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.11","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/video/fbdev/smscufx.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/3b3d3127f5b4291ae4caaf50f7b66089ad600480"},{"url":"https://git.kernel.org/stable/c/3931014367ef31d26af65386a4ca496f50f0cfdf"},{"url":"https://git.kernel.org/stable/c/64fa364ad3245508d393e16ed4886f92d7eb423c"},{"url":"https://git.kernel.org/stable/c/1b4c08844628dfc8d72d3f51b657f2a5e63b7b4b"},{"url":"https://git.kernel.org/stable/c/b76449ee75e21acfe9fa4c653d8598f191ed7d68"}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-05-23T15:22:49.418Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.4.223","versionEndExcluding":"5.4.232"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.10.153","versionEndExcluding":"5.10.168"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15.77","versionEndExcluding":"5.15.93"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.1","versionEndExcluding":"6.1.11"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.1","versionEndExcluding":"6.2"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.9.332"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.14.298"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.19.264"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.0.7"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.5,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"NONE"}},{"other":{"type":"ssvc","content":{"timestamp":"2025-10-01T17:36:16.841127Z","id":"CVE-2022-49741","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-401","type":"CWE","lang":"en","description":"CWE-401 Missing Release of Memory after Effective Lifetime"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-10-01T17:36:19.689Z"}}]}}}