CVE-2022-48907: auxdisplay: lcd2s: Fix memory leak in ->remove()

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-08-22 · updated 2026-06-17
Weakness: CWE-401

Description

In the Linux kernel, the following vulnerability has been resolved: auxdisplay: lcd2s: Fix memory leak in ->remove() Once allocated the struct lcd2s_data is never freed. Fix the memory leak by switching to devm_kzalloc().

Affected products

Linux kernel: from 5.11 before 5.15.27; from 5.16 before 5.16.13; 5.17-rc1, 5.17-rc2, 5.17-rc3, 5.17-rc4, 5.17-rc5, 5.17-rc6 — fixed in 5.15.27, 5.16.13

How to fix

Upgrade to a fixed version: Linux kernel 5.15.27, 5.16.13. Check the vendor advisory for mitigations.

References

https://git.kernel.org/stable/c/3585ed5f9b11a6094dd991d76a1541e5d03b986a
https://git.kernel.org/stable/c/5d53cd33f4253aa4cf02bf7e670b3c6a99674351
https://git.kernel.org/stable/c/898c0a15425a5bcaa8d44bd436eae5afd2483796

Get alerted when CVE-2022-48907 or the next vulnerability affects your stack