{
  "schemaVersion": 1,
  "attribution": [
    {
      "source": "CISA Known Exploited Vulnerabilities",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "licence": "US government work"
    },
    {
      "source": "GitHub Advisory Database",
      "url": "https://github.com/advisories",
      "licence": "CC BY 4.0"
    },
    {
      "source": "Have I Been Pwned",
      "url": "https://haveibeenpwned.com/",
      "licence": "CC BY 4.0"
    },
    {
      "source": "CVE Program (CVE records)",
      "url": "https://www.cve.org/Legal/TermsOfUse",
      "licence": "CVE Terms of Use",
      "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.",
      "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy."
    },
    {
      "source": "FIRST EPSS",
      "url": "https://www.first.org/epss/",
      "licence": "free to use; FIRST requests attribution"
    }
  ],
  "record": {
    "id": "CVE-2022-49648",
    "sourceURL": "https://www.cve.org/CVERecord?id=CVE-2022-49648",
    "idYear": 2022,
    "status": "PUBLISHED",
    "publishedAt": "2025-02-26T02:23:52.035Z",
    "updatedAt": "2026-05-23T15:22:38.887Z",
    "importedAt": "2026-10-24T01:56:49.724Z",
    "snapshot": {
      "id": "cve_2026-10-24_midnight_baseline",
      "at": "2026-10-24T00:00:00.000Z",
      "source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z"
    },
    "facts": {
      "title": "tracing/histograms: Fix memory leak problem",
      "summary": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing/histograms: Fix memory leak problem\n\nThis reverts commit 46bbe5c671e06f070428b9be142cc4ee5cedebac.\n\nAs commit 46bbe5c671e0 (\"tracing: fix double free\") said, the\n\"double free\" problem reported by clang static analyzer is:\n  > In parse_var_defs() if there is a problem allocating\n  > var_defs.expr, the earlier var_defs.name is freed.\n  > This free is duplicated by free_var_defs() which frees\n  > the rest of the list.\n\nHowever, if there is a problem allocating N-th var_defs.expr:\n  + in parse_var_defs(), the freed 'earlier var_defs.name' is\n    actually the N-th var_defs.name;\n  + then in free_var_defs(), the names from 0th to (N-1)-th are freed;\n\n                        IF ALLOCATING PROBLEM HAPPENED HERE!!! -+\n                                                                 \\\n                                                                  |\n          0th           1th                 (N-1)-th      N-th    V\n          +-------------+-------------+-----+-------------+-----------\nvar_defs: | name | expr | name | expr | ... | name | expr | name | ///\n          +-------------+-------------+-----+-------------+-----------\n\nThese two frees don't act on same name, so there was no \"double free\"\nproblem before. Conversely, after that commit, we get a \"memory leak\"\nproblem because the above \"N-th var_defs.name\" is not freed.\n\nIf enable CONFIG_DEBUG_KMEMLEAK and inject a fault at where the N-th\nvar_defs.expr allocated, then execute on shell like:\n  $ echo 'hist:key=call_site:val=$v1,$v2:v1=bytes_req,v2=bytes_alloc' > \\\n/sys/kernel/debug/tracing/events/kmem/kmalloc/trigger\n\nThen kmemleak reports:\n  unreferenced object 0xffff8fb100ef3518 (size 8):\n    comm \"bash\", pid 196, jiffies 4295681690 (age 28.538s)\n    hex dump (first 8 bytes):\n      76 31 00 00 b1 8f ff ff                          v1......\n    backtrace:\n      [<0000000038fe4895>] kstrdup+0x2d/0x60\n      [<00000000c99c049a>] event_hist_trigger_parse+0x206f/0x20e0\n      [<00000000ae70d2cc>] trigger_process_regex+0xc0/0x110\n      [<0000000066737a4c>] event_trigger_write+0x75/0xd0\n      [<000000007341e40c>] vfs_write+0xbb/0x2a0\n      [<0000000087fde4c2>] ksys_write+0x59/0xd0\n      [<00000000581e9cdf>] do_syscall_64+0x3a/0x80\n      [<00000000cf3b065c>] entry_SYSCALL_64_after_hwframe+0x46/0xb0",
      "affected": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "240dd5118a9e0454f280ffeae63f22bd14735733",
              "status": "affected",
              "versionType": "git",
              "lessThan": "eb622d5580b9e2ff694f62da6410618bd73853cb"
            },
            {
              "version": "e92c490f104993cea35e5f5d5108ac12df1850ac",
              "status": "affected",
              "versionType": "git",
              "lessThan": "ecc6dec12c33aa92c086cd702af9f544ddaf3c75"
            },
            {
              "version": "46bbe5c671e06f070428b9be142cc4ee5cedebac",
              "status": "affected",
              "versionType": "git",
              "lessThan": "78a1400c42ee11197eb1f0f85ba51df9a4fdfff0"
            },
            {
              "version": "46bbe5c671e06f070428b9be142cc4ee5cedebac",
              "status": "affected",
              "versionType": "git",
              "lessThan": "22eeff55679d9e7c0f768c79bfbd83e2f8142d89"
            },
            {
              "version": "46bbe5c671e06f070428b9be142cc4ee5cedebac",
              "status": "affected",
              "versionType": "git",
              "lessThan": "4d453eb5e1eec89971aa5b3262857ee26cfdffd3"
            },
            {
              "version": "46bbe5c671e06f070428b9be142cc4ee5cedebac",
              "status": "affected",
              "versionType": "git",
              "lessThan": "7edc3945bdce9c39198a10d6129377a5c53559c2"
            },
            {
              "version": "e3a23511638a3dcf0275c1e71a46d1ca2e2e6788",
              "status": "affected",
              "versionType": "git"
            },
            {
              "version": "4.19.149",
              "status": "affected",
              "versionType": "semver",
              "lessThan": "4.19.253"
            },
            {
              "version": "5.4.69",
              "status": "affected",
              "versionType": "semver",
              "lessThan": "5.4.207"
            },
            {
              "version": "5.8.13",
              "status": "affected",
              "versionType": "semver",
              "lessThan": "5.9"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "versions": [
            {
              "version": "5.9",
              "status": "affected"
            },
            {
              "version": "0",
              "status": "unaffected",
              "versionType": "semver",
              "lessThan": "5.9"
            },
            {
              "version": "4.19.253",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "4.19.*"
            },
            {
              "version": "5.4.207",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "5.4.*"
            },
            {
              "version": "5.10.132",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "version": "5.15.56",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "version": "5.18.13",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "5.18.*"
            },
            {
              "version": "5.19",
              "status": "unaffected",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ]
        }
      ]
    }
  }
}