CVE-2022-49951 firmware_loader: Fix use-after-free during unregister
A use-after-free in the Linux kernel firmware loader allows attackers to potentially execute code or escalate privileges during device unregistration.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-49951?
CVE-2022-49951 is a high-severity use after free vulnerability in Linux kernel, published on 18 Jun 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
firmware_loader: Fix use-after-free during unregister
In the following code within firmware_upload_unregister(), the call to device_unregister() could result in the dev_release function freeing the fw_upload_priv structure before it is dereferenced for the call to module_put(). This bug was found by the kernel test robot using CONFIG_KASAN while running the firmware selftests.
device_unregister(&fw_sysfs->dev); module_put(fw_upload_priv->module);
The problem is fixed by copying fw_upload_priv->module to a local variable for use when calling device_unregister().
Weakness: CWE-416
Which versions are affected by CVE-2022-49951?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2022-49951?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2022-49951 being exploited?
There is no known exploitation of CVE-2022-49951 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as DEBIAN-CVE-2022-49951, GHSA-m4jv-hg4p-x3x5, UBUNTU-CVE-2022-49951.