What’s Vulnerable › Vulnerabilities

CVE-2022-49619: net: sfp: fix memory leak in sfp_probe()

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-02-26 · updated 2026-06-17
• Weakness: CWE-401

Description

In the Linux kernel, the following vulnerability has been resolved: net: sfp: fix memory leak in sfp_probe() sfp_probe() allocates a memory chunk from sfp with sfp_alloc(). When devm_add_action() fails, sfp is not freed, which leads to a memory leak. We should use devm_add_action_or_reset() instead of devm_add_action().

Affected products

• Linux kernel: before 4.14.289; from 4.15 before 4.19.253; from 4.20 before 5.4.207; from 5.5 before 5.10.132; from 5.11 before 5.15.56; from 5.16 before 5.18.13 — fixed in 4.14.289, 4.19.253, 5.10.132, 5.15.56, 5.18.13, 5.4.207

How to fix

Upgrade to a fixed version: Linux kernel 4.14.289, 4.19.253, 5.10.132, 5.15.56. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/0a18d802d65cf662644fd1d369c86d84a5630652
• https://git.kernel.org/stable/c/1545bc727625ea6e8decd717e5d1e8cc704ccf8f
• https://git.kernel.org/stable/c/204543581a2f26bb3b997a304c0bd06926ba7f15
• https://git.kernel.org/stable/c/67dc32542a1fb7790d0853cf4a5cf859ac6a2002
• https://git.kernel.org/stable/c/9ec5a97f327a89031fce6cfc3e95543c53936638
• https://git.kernel.org/stable/c/ede990cfc42775bd0141e21f37ee365dcaeeb50f
• https://git.kernel.org/stable/c/f22ddc8a5278d7fb6369a0aeb0d8775a0aefaaee

Get alerted when CVE-2022-49619 or the next vulnerability affects your stack