What’s Vulnerable › Vulnerabilities

CVE-2022-49713: usb: dwc2: Fix memory leak in dwc2_hcd_init

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-02-26 · updated 2026-06-17
• Weakness: CWE-401

Description

In the Linux kernel, the following vulnerability has been resolved: usb: dwc2: Fix memory leak in dwc2_hcd_init usb_create_hcd will alloc memory for hcd, and we should call usb_put_hcd to free it when platform_get_resource() fails to prevent memory leak. goto error2 label instead error1 to fix this.

Affected products

• Linux kernel: from 4.14.250 before 4.14.285; from 4.19.210 before 4.19.249; from 5.4.152 before 5.4.200; from 5.10.72 before 5.10.124; from 5.14.11 before 5.15.49; from 5.16 before 5.18.6 — fixed in 4.14.285, 4.19.249, 5.10.124, 5.15.49, 5.18.6, 5.4.200

How to fix

Upgrade to a fixed version: Linux kernel 4.14.285, 4.19.249, 5.10.124, 5.15.49. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/3755278f078460b021cd0384562977bf2039a57a
• https://git.kernel.org/stable/c/52bfcedbfd5bf962dbdcb6e761f4d0dd3ba26dfd
• https://git.kernel.org/stable/c/6506aff2dc2f7059aa3d45ee2e8639b25e87090f
• https://git.kernel.org/stable/c/701d8ec01e0f229d4db6f43d3d64ee479120cbeb
• https://git.kernel.org/stable/c/84e6d0af87e27bbc0db94f2e7323b34abe17b6e5
• https://git.kernel.org/stable/c/981ee40649e5fd9550f82db1fbb3bfab037da346
• https://git.kernel.org/stable/c/a44a8a762f7fe9ad3c065813d058e835a6180cb2

Get alerted when CVE-2022-49713 or the next vulnerability affects your stack