CVE-2022-49926: net: dsa: Fix possible memory leaks in dsa_loop_init()
In the Linux kernel, the following vulnerability has been resolved:
net: dsa: Fix possible memory leaks in dsa_loop_init()
kmemleak reported memory leaks in dsa_loop_init():
kmemleak: 12 new suspected memory leaks
unreferenced object 0xffff8880138ce000 (size 2048):
comm "modprobe", pid 390, jiffies 4295040478 (age 238.976s)
backtrace:
[<000000006a94f1d5>] kmalloc_trace+0x26/0x60
[<00000000a9c44622>] phy_device_create+0x5d/0x970
[<00000000d0ee2afc>] get_phy_device+0xf3/0x2b0
[<00000000dca0c71f>] __fixed_phy_register.part.0+0x92/0x4e0
[<000000008a834798>] fixed_phy_register+0x84/0xb0
[<0000000055223fcb>] dsa_loop_init+0xa9/0x116 [dsa_loop]
...
There are two reasons for memleak in dsa_loop_init().
First, fixed_phy_register() create and register phy_device:
fixed_phy_register()
get_phy_device()
phy_device_create() # freed by phy_device_free()
phy_device_register() # freed by phy_device_remove()
But fixed_phy_unregister() only calls phy_device_remove().
So the memory allocated in phy_device_create() is leaked.
Second, when mdio_driver_register() fail in dsa_loop_init(),
it just returns and there is no cleanup for phydevs.
Fix the problems by catching the error of mdio_driver_register()
in dsa_loop_init(), then calling both fixed_phy_unregister() and
phy_device_free() to release phydevs.
Also add a function for phydevs cleanup to avoid duplacate.
Security readout for executives and security teams
Plain-English summary
CVE-2022-49926 is a Linux kernel memory leak in the DSA loop initialization path. A local low-privileged user could potentially trigger resource exhaustion, affecting system availability. The CVSS score is 5.5. There is no cited evidence of active exploitation or KEV listing.
Executive priority
Treat as a moderate availability risk. Prioritize patching shared Linux systems, multi-user environments, and infrastructure where local users or workloads are less trusted. This is not currently supported by sources as an internet-facing emergency.
Technical view
The issue is CWE-401 in dsa_loop_init(). fixed_phy_register() allocates phy_device memory that was not fully freed, and mdio_driver_register() failure skipped phydev cleanup. Kernel fixes add error handling and cleanup using fixed_phy_unregister() plus phy_device_free().
Likely exposure
Exposure is limited to affected Linux kernels where the dsa_loop code can be loaded or exercised locally. The source bundle lists Linux kernel versions and stable commit fixes, but distro-specific backport status must be checked separately.
Exploitation context
The CVSS vector is local, low complexity, low privileges, no user interaction, with high availability impact. Sources do not show remote exploitation, privilege escalation, data theft, KEV listing, or active exploitation.
Researcher notes
The record describes memory leaks detected by kmemleak during modprobe. The fix addresses two cleanup gaps in dsa_loop_init(). Affected-version mapping in the bundle is commit/version based and may not directly match vendor kernels.
Mitigation direction
Update to a Linux kernel containing the referenced stable fixes.
Check your Linux distribution security advisories for backported fixes.
Prioritize systems where untrusted local users can load or trigger kernel modules.
If immediate patching is unavailable, follow vendor guidance for risk reduction.
Validation and detection
Inventory Linux kernel versions across servers, appliances, and images.
Check whether vendor kernel packages include the referenced stable commits.
Review whether dsa_loop is present or loaded on relevant systems.
Confirm vulnerability scanner findings against distro-specific backport information.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Potential ATT&CK relevance
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
cwe · low confidence lookup
CWE-401: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
CWE-401 · source CWE mapping
Missing Release of Memory after Effective Lifetime
Missing Release of Memory after Effective Lifetime represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.