{
  "cveId": "CVE-2022-49276",
  "url": "https://patchblox.com/security/cve/CVE-2022-49276",
  "summary": "CVE-2022-49276 is fixed in linux on 1 platform, first by DEBIAN-CVE-2022-49276, released February 26, 2025. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  jffs2: fix memory leak in jffs2_scan_medium  If...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  jffs2: fix memory leak in jffs2_scan_medium  If an error is returned in jffs2_scan_eraseblock() and some memory has been added to the jffs2_summary *s, we can observe the following kmemleak report:  -------------------------------------------- unreferenced object 0xffff88812b889c40 (size 64):   comm \u0022mount\u0022, pid 692, jiffies 4294838325 (age 34.288s)   hex dump (first 32 bytes):     40 48 b5 14 81 88 ff ff 01 e0 31 00 00 00 50 00  @H........1...P.     00 00 01 00 00 00 01 00 00 00 02 00 00 00 09 08  ................   backtrace:     [\u003Cffffffffae93a3a3\u003E] __kmalloc\u002B0x613/0x910     [\u003Cffffffffaf423b9c\u003E] jffs2_sum_add_dirent_mem\u002B0x5c/0xa0     [\u003Cffffffffb0f3afa8\u003E] jffs2_scan_medium.cold\u002B0x36e5/0x4794     [\u003Cffffffffb0f3dbe1\u003E] jffs2_do_mount_fs.cold\u002B0xa7/0x2267     [\u003Cffffffffaf40acf3\u003E] jffs2_do_fill_super\u002B0x383/0xc30     [\u003Cffffffffaf40c00a\u003E] jffs2_fill_super\u002B0x2ea/0x4c0     [\u003Cffffffffb0315d64\u003E] mtd_get_sb\u002B0x254/0x400     [\u003Cffffffffb0315f5f\u003E] mtd_get_sb_by_nr\u002B0x4f/0xd0     [\u003Cffffffffb0316478\u003E] get_tree_mtd\u002B0x498/0x840     [\u003Cffffffffaf40bd15\u003E] jffs2_get_tree\u002B0x25/0x30     [\u003Cffffffffae9f358d\u003E] vfs_get_tree\u002B0x8d/0x2e0     [\u003Cffffffffaea7a98f\u003E] path_mount\u002B0x50f/0x1e50     [\u003Cffffffffaea7c3d7\u003E] do_mount\u002B0x107/0x130     [\u003Cffffffffaea7c5c5\u003E] __se_sys_mount\u002B0x1c5/0x2f0     [\u003Cffffffffaea7c917\u003E] __x64_sys_mount\u002B0xc7/0x160     [\u003Cffffffffb10142f5\u003E] do_syscall_64\u002B0x45/0x70 unreferenced object 0xffff888114b54840 (size 32):   comm \u0022mount\u0022, pid 692, jiffies 4294838325 (age 34.288s)   hex dump (first 32 bytes):     c0 75 b5 14 81 88 ff ff 02 e0 02 00 00 00 02 00  .u..............     00 00 84 00 00 00 44 00 00 00 6b 6b 6b 6b 6b a5  ......D...kkkkk.   backtrace:     [\u003Cffffffffae93be24\u003E] kmem_cache_alloc_trace\u002B0x584/0x880     [\u003Cffffffffaf423b04\u003E] jffs2_sum_add_inode_mem\u002B0x54/0x90     [\u003Cffffffffb0f3bd44\u003E] jffs2_scan_medium.cold\u002B0x4481/0x4794     [...] unreferenced object 0xffff888114b57280 (size 32):   comm \u0022mount\u0022, pid 692, jiffies 4294838393 (age 34.357s)   hex dump (first 32 bytes):     10 d5 6c 11 81 88 ff ff 08 e0 05 00 00 00 01 00  ..l.............     00 00 38 02 00 00 28 00 00 00 6b 6b 6b 6b 6b a5  ..8...(...kkkkk.   backtrace:     [\u003Cffffffffae93be24\u003E] kmem_cache_alloc_trace\u002B0x584/0x880     [\u003Cffffffffaf423c34\u003E] jffs2_sum_add_xattr_mem\u002B0x54/0x90     [\u003Cffffffffb0f3a24f\u003E] jffs2_scan_medium.cold\u002B0x298c/0x4794     [...] unreferenced object 0xffff8881116cd510 (size 16):   comm \u0022mount\u0022, pid 692, jiffies 4294838395 (age 34.355s)   hex dump (first 16 bytes):     00 00 00 00 00 00 00 00 09 e0 60 02 00 00 6b a5  ..........\u0060...k.   backtrace:     [\u003Cffffffffae93be24\u003E] kmem_cache_alloc_trace\u002B0x584/0x880     [\u003Cffffffffaf423cc4\u003E] jffs2_sum_add_xref_mem\u002B0x54/0x90     [\u003Cffffffffb0f3b2e3\u003E] jffs2_scan_medium.cold\u002B0x3a20/0x4794     [...] --------------------------------------------  Therefore, we should call jffs2_sum_reset_collected(s) on exit to release the memory added in s. In addition, a new tag \u0022out_buf\u0022 is added to prevent the NULL pointer reference caused by s being NULL. (thanks to Zhang Yi for this analysis)",
  "published": "2025-02-26T07:01:04Z",
  "severity": "medium",
  "cvss": 5.5,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
  "epss": 0.00268,
  "epssPercentile": 0.19063,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "5.17.3-1",
      "fix": "DEBIAN-CVE-2022-49276",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-49276",
      "released": "2025-02-26T07:01:04Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "5.17.3-1",
      "fix": "DEBIAN-CVE-2022-49276",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-49276",
      "released": "2025-02-26T07:01:04Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "5.17.3-1",
      "fix": "DEBIAN-CVE-2022-49276",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-49276",
      "released": "2025-02-26T07:01:04Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T13:06:02Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}