{
  "cveId": "CVE-2022-49926",
  "url": "https://patchblox.com/security/cve/CVE-2022-49926",
  "summary": "CVE-2022-49926 is fixed in linux on 1 platform, first by DEBIAN-CVE-2022-49926, released May 1, 2025. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  net: dsa: Fix possible memory leaks in dsa_loop_...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  net: dsa: Fix possible memory leaks in dsa_loop_init()  kmemleak reported memory leaks in dsa_loop_init():  kmemleak: 12 new suspected memory leaks  unreferenced object 0xffff8880138ce000 (size 2048):   comm \u0022modprobe\u0022, pid 390, jiffies 4295040478 (age 238.976s)   backtrace:     [\u003C000000006a94f1d5\u003E] kmalloc_trace\u002B0x26/0x60     [\u003C00000000a9c44622\u003E] phy_device_create\u002B0x5d/0x970     [\u003C00000000d0ee2afc\u003E] get_phy_device\u002B0xf3/0x2b0     [\u003C00000000dca0c71f\u003E] __fixed_phy_register.part.0\u002B0x92/0x4e0     [\u003C000000008a834798\u003E] fixed_phy_register\u002B0x84/0xb0     [\u003C0000000055223fcb\u003E] dsa_loop_init\u002B0xa9/0x116 [dsa_loop]     ...  There are two reasons for memleak in dsa_loop_init().  First, fixed_phy_register() create and register phy_device:  fixed_phy_register()   get_phy_device()     phy_device_create() # freed by phy_device_free()   phy_device_register() # freed by phy_device_remove()  But fixed_phy_unregister() only calls phy_device_remove(). So the memory allocated in phy_device_create() is leaked.  Second, when mdio_driver_register() fail in dsa_loop_init(), it just returns and there is no cleanup for phydevs.  Fix the problems by catching the error of mdio_driver_register() in dsa_loop_init(), then calling both fixed_phy_unregister() and phy_device_free() to release phydevs. Also add a function for phydevs cleanup to avoid duplacate.",
  "published": "2025-05-01T15:16:18Z",
  "severity": "medium",
  "cvss": 5.5,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
  "epss": 0.00188,
  "epssPercentile": 0.08507,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "6.0.8-1",
      "fix": "DEBIAN-CVE-2022-49926",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-49926",
      "released": "2025-05-01T15:16:18Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "6.0.8-1",
      "fix": "DEBIAN-CVE-2022-49926",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-49926",
      "released": "2025-05-01T15:16:18Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "6.0.8-1",
      "fix": "DEBIAN-CVE-2022-49926",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-49926",
      "released": "2025-05-01T15:16:18Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T13:06:02Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}