CVE-2022-49608

Summary

CVE-2022-49608 is a Linux kernel vulnerability that affects the pinctrl subsystem of certain Ralink drivers. The issue lies in the failure to properly check for a null return value when using devm_kcalloc. This failure can result in a NULL pointer being assigned to data->domains, leading to a dereference of the NULL pointer at a later stage. To mitigate this issue, it is recommended to directly return -ENOMEM instead of releasing data manually if the allocation fails, as the comment of devm_kmalloc states that the memory allocated with this function is automatically freed on driver detach.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.