{"cve":"CVE-2022-49741","nvd":{"published":"2025-03-27T17:15:38.720","modified":"2026-06-17T05:19:00.953","status":"Modified","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: smscufx: fix error handling code in ufx_usb_probe\n\nThe current error handling code in ufx_usb_probe have many unmatching\nissues, e.g., missing ufx_free_usb_list, destroy_modedb label should\nonly include framebuffer_release, fb_dealloc_cmap only matches\nfb_alloc_cmap.\n\nMy local syzkaller reports a memory leak bug:\n\nmemory leak in ufx_usb_probe\n\nBUG: memory leak\nunreferenced object 0xffff88802f879580 (size 128):\n  comm \"kworker/0:7\", pid 17416, jiffies 4295067474 (age 46.710s)\n  hex dump (first 32 bytes):\n    80 21 7c 2e 80 88 ff ff 18 d0 d0 0c 80 88 ff ff  .!|.............\n    00 d0 d0 0c 80 88 ff ff e0 ff ff ff 0f 00 00 00  ................\n  backtrace:\n    [<ffffffff814c99a0>] kmalloc_trace+0x20/0x90 mm/slab_common.c:1045\n    [<ffffffff824d219c>] kmalloc include/linux/slab.h:553 [inline]\n    [<ffffffff824d219c>] kzalloc include/linux/slab.h:689 [inline]\n    [<ffffffff824d219c>] ufx_alloc_urb_list drivers/video/fbdev/smscufx.c:1873 [inline]\n    [<ffffffff824d219c>] ufx_usb_probe+0x11c/0x15a0 drivers/video/fbdev/smscufx.c:1655\n    [<ffffffff82d17927>] usb_probe_interface+0x177/0x370 drivers/usb/core/driver.c:396\n    [<ffffffff82712f0d>] call_driver_probe drivers/base/dd.c:560 [inline]\n    [<ffffffff82712f0d>] really_probe+0x12d/0x390 drivers/base/dd.c:639\n    [<ffffffff8271322f>] __driver_probe_device+0xbf/0x140 drivers/base/dd.c:778\n    [<ffffffff827132da>] driver_probe_device+0x2a/0x120 drivers/base/dd.c:808\n    [<ffffffff82713c27>] __device_attach_driver+0xf7/0x150 drivers/base/dd.c:936\n    [<ffffffff82710137>] bus_for_each_drv+0xb7/0x100 drivers/base/bus.c:427\n    [<ffffffff827136b5>] __device_attach+0x105/0x2d0 drivers/base/dd.c:1008\n    [<ffffffff82711d36>] bus_probe_device+0xc6/0xe0 drivers/base/bus.c:487\n    [<ffffffff8270e242>] device_add+0x642/0xdc0 drivers/base/core.c:3517\n    [<ffffffff82d14d5f>] usb_set_configuration+0x8ef/0xb80 drivers/usb/core/message.c:2170\n    [<ffffffff82d2576c>] usb_generic_driver_probe+0x8c/0xc0 drivers/usb/core/generic.c:238\n    [<ffffffff82d16ffc>] usb_probe_device+0x5c/0x140 drivers/usb/core/driver.c:293\n    [<ffffffff82712f0d>] call_driver_probe drivers/base/dd.c:560 [inline]\n    [<ffffffff82712f0d>] really_probe+0x12d/0x390 drivers/base/dd.c:639\n    [<ffffffff8271322f>] __driver_probe_device+0xbf/0x140 drivers/base/dd.c:778\n\nFix this bug by rewriting the error handling code in ufx_usb_probe.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","score":5.5},"cwes":["CWE-401"],"references":["https://git.kernel.org/stable/c/1b4c08844628dfc8d72d3f51b657f2a5e63b7b4b","https://git.kernel.org/stable/c/3931014367ef31d26af65386a4ca496f50f0cfdf","https://git.kernel.org/stable/c/3b3d3127f5b4291ae4caaf50f7b66089ad600480","https://git.kernel.org/stable/c/64fa364ad3245508d393e16ed4886f92d7eb423c","https://git.kernel.org/stable/c/b76449ee75e21acfe9fa4c653d8598f191ed7d68"],"products":["linux:linux_kernel"],"source":"nvd","synced_at":"2026-10-19T22:00:28.034033815+00:00"},"epss":{"cve":"CVE-2022-49741","score":0.00194,"percentile":0.09108,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}