{ "schemaVersion": 1, "attribution": [ { "source": "CISA Known Exploited Vulnerabilities", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "licence": "US government work" }, { "source": "GitHub Advisory Database", "url": "https://github.com/advisories", "licence": "CC BY 4.0" }, { "source": "Have I Been Pwned", "url": "https://haveibeenpwned.com/", "licence": "CC BY 4.0" }, { "source": "CVE Program (CVE records)", "url": "https://www.cve.org/Legal/TermsOfUse", "licence": "CVE Terms of Use", "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.", "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy." }, { "source": "FIRST EPSS", "url": "https://www.first.org/epss/", "licence": "free to use; FIRST requests attribution" } ], "record": { "id": "CVE-2022-50545", "sourceURL": "https://www.cve.org/CVERecord?id=CVE-2022-50545", "idYear": 2022, "status": "PUBLISHED", "publishedAt": "2025-10-07T15:21:09.288Z", "updatedAt": "2026-05-11T19:21:29.824Z", "importedAt": "2026-10-24T01:56:49.724Z", "snapshot": { "id": "cve_2026-10-24_midnight_baseline", "at": "2026-10-24T00:00:00.000Z", "source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z" }, "facts": { "title": "r6040: Fix kmemleak in probe and remove", "summary": "In the Linux kernel, the following vulnerability has been resolved:\n\nr6040: Fix kmemleak in probe and remove\n\nThere is a memory leaks reported by kmemleak:\n\n unreferenced object 0xffff888116111000 (size 2048):\n comm \"modprobe\", pid 817, jiffies 4294759745 (age 76.502s)\n hex dump (first 32 bytes):\n 00 c4 0a 04 81 88 ff ff 08 10 11 16 81 88 ff ff ................\n 08 10 11 16 81 88 ff ff 00 00 00 00 00 00 00 00 ................\n backtrace:\n [] kmalloc_trace+0x22/0x60\n [] phy_device_create+0x4e/0x90\n [] get_phy_device+0xd2/0x220\n [] mdiobus_scan+0xa4/0x2e0\n [] __mdiobus_register+0x482/0x8b0\n [] r6040_init_one+0x714/0xd2c [r6040]\n ...\n\nThe problem occurs in probe process as follows:\n r6040_init_one:\n mdiobus_register\n mdiobus_scan <- alloc and register phy_device,\n the reference count of phy_device is 3\n r6040_mii_probe\n phy_connect <- connect to the first phy_device,\n so the reference count of the first\n phy_device is 4, others are 3\n register_netdev <- fault inject succeeded, goto error handling path\n\n // error handling path\n err_out_mdio_unregister:\n mdiobus_unregister(lp->mii_bus);\n err_out_mdio:\n mdiobus_free(lp->mii_bus); <- the reference count of the first\n phy_device is 1, it is not released\n and other phy_devices are released\n // similarly, the remove process also has the same problem\n\nThe root cause is traced to the phy_device is not disconnected when\nremoves one r6040 device in r6040_remove_one() or on error handling path\nafter r6040_mii probed successfully. In r6040_mii_probe(), a net ethernet\ndevice is connected to the first PHY device of mii_bus, in order to\nnotify the connected driver when the link status changes, which is the\ndefault behavior of the PHY infrastructure to handle everything.\nTherefore the phy_device should be disconnected when removes one r6040\ndevice or on error handling path.\n\nFix it by adding phy_disconnect() when removes one r6040 device or on\nerror handling path after r6040_mii probed successfully.", "affected": [ { "vendor": "Linux", "product": "Linux", "defaultStatus": "unaffected", "versions": [ { "version": "3831861b4ad8fd0ad7110048eb3e155628799d2b", "status": "affected", "versionType": "git", "lessThan": "a04707f4596952049da05756c27398c34d9a1d36" }, { "version": "3831861b4ad8fd0ad7110048eb3e155628799d2b", "status": "affected", "versionType": "git", "lessThan": "b4448816e6a565e08236a6009c6bf48c6836cdfd" }, { "version": "3831861b4ad8fd0ad7110048eb3e155628799d2b", "status": "affected", "versionType": "git", "lessThan": "2ce242e1b9ad31c1f68496b3548e407a8cb2c07d" }, { "version": "3831861b4ad8fd0ad7110048eb3e155628799d2b", "status": "affected", "versionType": "git", "lessThan": "b0a61359026b57a287a48fbb4ba1d097023eca3e" }, { "version": "3831861b4ad8fd0ad7110048eb3e155628799d2b", "status": "affected", "versionType": "git", "lessThan": "3d5f83a62e8235d235534b3dc6f197d8a822c269" }, { "version": "3831861b4ad8fd0ad7110048eb3e155628799d2b", "status": "affected", "versionType": "git", "lessThan": "9b5b50329e2e966831a7237dd6949e7b5362a49a" }, { "version": "3831861b4ad8fd0ad7110048eb3e155628799d2b", "status": "affected", "versionType": "git", "lessThan": "ad2c8f25457ca9a81e7e958148cbc26600ce3071" }, { "version": "3831861b4ad8fd0ad7110048eb3e155628799d2b", "status": "affected", "versionType": "git", "lessThan": "5944c25c67de54e0aa53623e1e1af3bf8b16ed44" }, { "version": "3831861b4ad8fd0ad7110048eb3e155628799d2b", "status": "affected", "versionType": "git", "lessThan": "7e43039a49c2da45edc1d9d7c9ede4003ab45a5f" } ] }, { "vendor": "Linux", "product": "Linux", "defaultStatus": "affected", "versions": [ { "version": "2.6.36", "status": "affected" }, { "version": "0", "status": "unaffected", "versionType": "semver", "lessThan": "2.6.36" }, { "version": "4.9.337", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "4.9.*" }, { "version": "4.14.303", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "4.14.*" }, { "version": "4.19.270", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "4.19.*" }, { "version": "5.4.229", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "5.4.*" }, { "version": "5.10.163", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "5.10.*" }, { "version": "5.15.86", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "5.15.*" }, { "version": "6.0.16", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "6.0.*" }, { "version": "6.1.2", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "6.1.*" }, { "version": "6.2", "status": "unaffected", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*" } ] } ] } } }