CVE-2022-49549: linux kernel

csirt@kutim:~/threat-intel/cve/CVE-2022-49549

CVSS 5.5 · Medium EPSS 0,27%

Kerentanan Missing Release of Memory after Effective Lifetime pada linux kernel. Skor CVSS 3.1 5.5 (Medium) menurut NVD.

Deskripsi (NVD)

In the Linux kernel, the following vulnerability has been resolved: x86/MCE/AMD: Fix memory leak when threshold_create_bank() fails In mce_threshold_create_device(), if threshold_create_bank() fails, the previously allocated threshold banks array @bp will be leaked because the call to mce_threshold_remove_device() will not free it. This happens because mce_threshold_remove_device() fetches the pointer through the threshold_banks per-CPU variable but bp is written there only after the bank creation is successful, and not before, when threshold_create_bank() fails. Add a helper which unwinds all the bank creation work previously done and pass into it the previously allocated threshold banks array for freeing. [ bp: Massage. ]

Rincian

Terbit di NVD: 26 Februari 2025
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 5.5 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-401: Missing Release of Memory after Effective Lifetime
EPSS (30 hari): 0,27% peluang dieksploitasi; lebih tinggi dari 17,6% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
linux	linux kernel	Versi 5.8 hingga sebelum 5.10.121
linux	linux kernel	Versi 5.11 hingga sebelum 5.15.46
linux	linux kernel	Versi 5.16 hingga sebelum 5.17.14
linux	linux kernel	Versi 5.18 hingga sebelum 5.18.3

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.