CVE-2022-50545r6040: Fix kmemleak in probe and remove
- 5.5MediumCVSS base score
- 0.21%Exploitation in 30 daysEPSS · top 88% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: r6040: Fix kmemleak in probe and remove There is a memory leaks reported by kmemleak: unreferenced object 0xffff888116111000 (size 2048): comm "modprobe", pid 817, jiffies 4294759745 (age 76.502s) hex dump (first 32 bytes): 00 c4 0a 04 81 88 ff ff 08 10 11 16 81 88 ff ff ................ 08 10 11 16 81 88 ff ff 00 00 00 00 00 00 00 00 ................ backtrace: [<ffffffff815bcd82>] kmalloc_trace+0x22/0x60 [<ffffffff827e20ee>] phy_device_create+0x4e/0x90 [<ffffffff827e6072>] get_phy_device+0xd2/0x220 [<ffffffff827e7844>] mdiobus_scan+0xa4/0x2e0 [<ffffffff827e8be2>] __mdiobus_register+0x482/0x8b0 [<ffffffffa01f5d24>] r6040_init_one+0x714/0xd2c [r6040] ... The problem occurs in probe process as follows: r6040_init_one: mdiobus_register mdiobus_scan <- alloc and register phy_device, the reference count of phy_device is 3 r6040_mii_probe phy_connect <- connect to the first phy_device, so the reference count of the first phy_device is 4, others are 3 register_netdev <- fault inject succeeded, goto error handling path // error handling path err_out_mdio_unregister: mdiobus_unregister(lp->mii_bus); err_out_mdio: mdiobus_free(lp->mii_bus); <- the reference count of the first phy_device is 1, it is not released and other phy_devices are released // similarly, the remove process also has the same problem The root cause is traced to the phy_device is not disconnected when removes one r6040 device in r6040_remove_one() or on error handling path after r6040_mii probed successfully. In r6040_mii_probe(), a net ethernet device is connected to the first PHY device of mii_bus, in order to notify the connected driver when the link status changes, which is the default behavior of the PHY infrastructure to handle everything. Therefore the phy_device should be disconnected when removes one r6040 device or on error handling path. Fix it by adding phy_disconnect() when removes one r6040 device or on error handling path after r6040_mii probed successfully.
Timeline
ID reserved
By Linux
Published
- 7 months later
· 7 months later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| NVDNVD · Analyzed | 3.1 | Medium5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
- EPSS (exploitation in 30 days)
- 0.21% · top 88% of all CVEs (15 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.5.
Affected products
- affected 3831861b4ad8fd0ad7110048eb3e155628799d2b – < a04707f4596952049da05756c27398c34d9a1d36
- affected 3831861b4ad8fd0ad7110048eb3e155628799d2b – < b4448816e6a565e08236a6009c6bf48c6836cdfd
- affected 3831861b4ad8fd0ad7110048eb3e155628799d2b – < 2ce242e1b9ad31c1f68496b3548e407a8cb2c07d
- affected 3831861b4ad8fd0ad7110048eb3e155628799d2b – < b0a61359026b57a287a48fbb4ba1d097023eca3e
- affected 3831861b4ad8fd0ad7110048eb3e155628799d2b – < 3d5f83a62e8235d235534b3dc6f197d8a822c269
- affected 3831861b4ad8fd0ad7110048eb3e155628799d2b – < 9b5b50329e2e966831a7237dd6949e7b5362a49a
- affected 3831861b4ad8fd0ad7110048eb3e155628799d2b – < ad2c8f25457ca9a81e7e958148cbc26600ce3071
- affected 3831861b4ad8fd0ad7110048eb3e155628799d2b – < 5944c25c67de54e0aa53623e1e1af3bf8b16ed44
- affected 3831861b4ad8fd0ad7110048eb3e155628799d2b – < 7e43039a49c2da45edc1d9d7c9ede4003ab45a5f
- affected 2.6.36
- unaffected < 2.6.36
- unaffected 4.9.337 – ≤ 4.9.*
- unaffected 4.14.303 – ≤ 4.14.*
- unaffected 4.19.270 – ≤ 4.19.*
- unaffected 5.4.229 – ≤ 5.4.*
- unaffected 5.10.163 – ≤ 5.10.*
- unaffected 5.15.86 – ≤ 5.15.*
- unaffected 6.0.16 – ≤ 6.0.*
- unaffected 6.1.2 – ≤ 6.1.*
- unaffected 6.2 – ≤ *
References
References9
- https://git.kernel.org/stable/c/a04707f4596952049da05756c27398c34d9a1d36 (opens in a new tab)
- https://git.kernel.org/stable/c/b4448816e6a565e08236a6009c6bf48c6836cdfd (opens in a new tab)
- https://git.kernel.org/stable/c/2ce242e1b9ad31c1f68496b3548e407a8cb2c07d (opens in a new tab)
- https://git.kernel.org/stable/c/b0a61359026b57a287a48fbb4ba1d097023eca3e (opens in a new tab)
- https://git.kernel.org/stable/c/3d5f83a62e8235d235534b3dc6f197d8a822c269 (opens in a new tab)
- https://git.kernel.org/stable/c/9b5b50329e2e966831a7237dd6949e7b5362a49a (opens in a new tab)
- https://git.kernel.org/stable/c/ad2c8f25457ca9a81e7e958148cbc26600ce3071 (opens in a new tab)
- https://git.kernel.org/stable/c/5944c25c67de54e0aa53623e1e1af3bf8b16ed44 (opens in a new tab)
- https://git.kernel.org/stable/c/7e43039a49c2da45edc1d9d7c9ede4003ab45a5f (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2025-32019 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2022-50545)Record last updated .