In the Linux kernel, the following vulnerability has been resolved: HID: elan: Fix potential double free in elan_input_configured 'input' is a managed resource allocated with devm_input_allocate_device(), so there is no need to call input_free_device() explicitly or there will be a double free. According to the doc of devm_input_allocate_device(): * Managed input devices do not need to be explicitly unregistered or * freed as it will be done automatically when owner device unbinds from * its driver (or binding fails).

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact total

Affected Vendors & Products

Vendors Products
Linux
  • Linux Kernel

Configuration 1 [-]

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

No data.

References
Link Providers
https://git.kernel.org/stable/c/1af20714fedad238362571620be0bd690ded05b6 cve-icon cve-icon
https://git.kernel.org/stable/c/24f9dfdaece9bd75bb8dbfdba83eddeefdf7dc47 cve-icon cve-icon
https://git.kernel.org/stable/c/5291451851feeb66fd4bf0826710f482f3b1ab38 cve-icon cve-icon
https://git.kernel.org/stable/c/6d0726725c7c560495f5ff364862a2cefea542e3 cve-icon cve-icon
https://git.kernel.org/stable/c/8bb1716507ebf12d50bbf181764481de3b6bc7fd cve-icon cve-icon
https://git.kernel.org/stable/c/c92ec22a991778a096342cf1a917ae36c5c86a90 cve-icon cve-icon
https://git.kernel.org/stable/c/f1d4f19a796551edc6679a681ea1756b8c578c08 cve-icon cve-icon
https://lore.kernel.org/linux-cve-announce/2025022609-CVE-2022-49508-c351@gregkh/T cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2022-49508 cve-icon
https://www.cve.org/CVERecord?id=CVE-2022-49508 cve-icon
History

Wed, 01 Oct 2025 20:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 17 Mar 2025 17:30:00 +0000

Type Values Removed Values Added
First Time appeared Linux
Linux linux Kernel
Weaknesses CWE-415
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

 cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Thu, 27 Feb 2025 13:30:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Moderate

Wed, 26 Feb 2025 02:45:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: HID: elan: Fix potential double free in elan_input_configured 'input' is a managed resource allocated with devm_input_allocate_device(), so there is no need to call input_free_device() explicitly or there will be a double free. According to the doc of devm_input_allocate_device(): * Managed input devices do not need to be explicitly unregistered or * freed as it will be done automatically when owner device unbinds from * its driver (or binding fails).
Title HID: elan: Fix potential double free in elan_input_configured
References
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2025-02-26T02:13:39.472Z

Updated: 2025-10-01T19:46:42.617Z

Reserved: 2025-02-26T02:08:31.587Z

Link: CVE-2022-49508

cve-icon Vulnrichment

Updated: 2025-10-01T16:49:08.359Z

cve-icon NVD

Status : Modified

Published: 2025-02-26T07:01:26.923

Modified: 2025-10-01T20:16:34.217

Link: CVE-2022-49508

cve-icon Redhat

Severity : Moderate

Publid Date: 2025-02-26T00:00:00Z

Links: CVE-2022-49508 - Bugzilla