What’s Vulnerable › Vulnerabilities

CVE-2022-49712: usb: gadget: lpc32xx_udc: Fix refcount leak in lpc32xx_udc_probe

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-02-26 · updated 2026-06-17

Description

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: lpc32xx_udc: Fix refcount leak in lpc32xx_udc_probe of_parse_phandle() returns a node pointer with refcount incremented, we should use of_node_put() on it when not need anymore. Add missing of_node_put() to avoid refcount leak. of_node_put() will check NULL pointer.

Affected products

• Linux kernel: from 3.5 before 4.9.320; from 4.10 before 4.14.285; from 4.15 before 4.19.249; from 4.20 before 5.4.200; from 5.5 before 5.10.124; from 5.11 before 5.15.49 — fixed in 4.14.285, 4.19.249, 4.9.320, 5.10.124, 5.15.49, 5.18.6

How to fix

Upgrade to a fixed version: Linux kernel 4.14.285, 4.19.249, 4.9.320, 5.10.124. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/0ef6917c0524da5b88496b9706628ffef108b9bb
• https://git.kernel.org/stable/c/2a598da14856ead80c726b38ba426c68637d9211
• https://git.kernel.org/stable/c/46da1e4a8b6329479433b2a4056941dfdd7f3efd
• https://git.kernel.org/stable/c/4757c9ade34178b351580133771f510b5ffcf9c8
• https://git.kernel.org/stable/c/57901c658f77d9ea2e772f35cb38e47efb54c558
• https://git.kernel.org/stable/c/727c82d003e0ec64411fd1257a9a57de4ad7a99a
• https://git.kernel.org/stable/c/b75bddfcc18170ce8e3fb695a76ec2dec4ce0ea5
• https://git.kernel.org/stable/c/d85e4e6284a91aa2d1ab004e9d84b9c09b4aa203

Get alerted when CVE-2022-49712 or the next vulnerability affects your stack