Memory Leak Vulnerability in Linux Kernel Affecting HNS Networking Devices

CVE-2022-50352

What is CVE-2022-50352?

A memory leak vulnerability in the Linux kernel has been identified, specifically in the handling of HNS networking devices. The issue arises when the device_register() function fails during module probing, resulting in an unreferenced object memory leak. This occurs if the reference count of the kobject does not drop to zero, preventing the allocated name from being freed. The vulnerability has been addressed by implementing a fix that calls put_device() to ensure proper memory cleanup through the callback function kobject_cleanup(), thereby mitigating potential memory management issues.

References