What’s Vulnerable › Vulnerabilities

CVE-2022-48880: platform/surface: aggregator: Add missing call to ssam_request_sync_free()

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-08-21 · updated 2026-06-17

Description

In the Linux kernel, the following vulnerability has been resolved: platform/surface: aggregator: Add missing call to ssam_request_sync_free() Although rare, ssam_request_sync_init() can fail. In that case, the request should be freed via ssam_request_sync_free(). Currently it is leaked instead. Fix this.

Affected products

• Linux kernel: from 5.12 before 5.15.89; from 5.16 before 6.1.7; 6.2-rc1, 6.2-rc2, 6.2-rc3 — fixed in 5.15.89, 6.1.7

How to fix

Upgrade to a fixed version: Linux kernel 5.15.89, 6.1.7. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/50b3cdf8239b11545f311c4f7b89e0092e4feedb
• https://git.kernel.org/stable/c/c965daac370f08a9b71d573a71d13cda76f2a884
• https://git.kernel.org/stable/c/d2dc110deabe7142b60ebeed689e67f92795ee24

Get alerted when CVE-2022-48880 or the next vulnerability affects your stack