CVE-2022-48880 — platform/surface: aggregator: Add missing call to ssam_request_sync_free()

Back Back to CVE browser

MEDIUM

platform/surface: aggregator: Add missing call to ssam_request_sync_free()

Published Aug 21, 2024

5.5

MEDIUM

CVSS 3.1

EPSS 0.24%

Description

Although rare, ssam_request_sync_init() can fail. In that case, the request should be freed via ssam_request_sync_free(). Currently it is leaked instead. Fix this.

Affected products

Vendor Linux Product Linux Default
unaffected
- Version
  c167b9c7e3d6
  Status
  affected
  Constraints
  <50b3cdf8239b
- Version
  c167b9c7e3d6
  Status
  affected
  Constraints
  <c965daac370f
- Version
  c167b9c7e3d6
  Status
  affected
  Constraints
  <d2dc110deabe
Vendor Linux Product Linux Default
affected
- Version
  5.12
  Status
  affected
  Constraints
  -
- Version
  0
  Status
  unaffected
  Constraints
  <5.12
- Version
  5.15.89
  Status
  unaffected
  Constraints
  <=5.15.*
- Version
  6.1.7
  Status
  unaffected
  Constraints
  <=6.1.*
- Version
  6.2
  Status
  unaffected
  Constraints
  <=*

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Linux

unaffected

Version	Status	Constraints
c167b9c7e3d6	affected	<50b3cdf8239b
c167b9c7e3d6	affected	<c965daac370f
c167b9c7e3d6	affected	<d2dc110deabe

Linux

affected

Version	Status	Constraints
5.12	affected	-
0	unaffected	<5.12
5.15.89	unaffected	<=5.15.*
6.1.7	unaffected	<=6.1.*
6.2	unaffected	<=*

Red Hat Enterprise Linux 6

kernel

Not affected
Red Hat Enterprise Linux 7

kernel

Not affected
Red Hat Enterprise Linux 7

kernel-rt

Not affected
Red Hat Enterprise Linux 8

kernel

Not affected
Red Hat Enterprise Linux 8

kernel-rt

Not affected
Red Hat Enterprise Linux 9

kernel

Not affected
Red Hat Enterprise Linux 9

kernel-rt

Not affected

Product	Package	State	Advisory
Red Hat Enterprise Linux 6	kernel	Not affected	n/a
Red Hat Enterprise Linux 7	kernel	Not affected	n/a
Red Hat Enterprise Linux 7	kernel-rt	Not affected	n/a
Red Hat Enterprise Linux 8	kernel	Not affected	n/a
Red Hat Enterprise Linux 8	kernel-rt	Not affected	n/a
Red Hat Enterprise Linux 9	kernel	Not affected	n/a
Red Hat Enterprise Linux 9	kernel-rt	Not affected	n/a

Remediation

Red Hat statement

Red Hat Enterprise Linux is not impacted by this CVE, as the vulnerability in question does not affect the specific versions or configurations of the Linux kernel used in its distributions. This ensures that users of Red Hat Enterprise Linux are not exposed to the potential risks associated with this issue, and no further action or mitigation is necessary for systems running this operating system.

Red Hat mitigation

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

Metrics

0.24% 0.00239

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 3, 2026.

EPSS probability 0.00239

Score over time

2024–2026

EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v3
EPSS v4
EPSS v5

Table of values (5 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 3, 2026	0.24% (0.00239)	13.57th	v5 (v2026.06.15)
Jun 15, 2026	0.24% (0.00239)	14.66th	v5 (v2026.06.15)
Mar 17, 2025	0.04% (0.00043)	10.10th	v4 (v2025.03.14)
Dec 12, 2024	0.04% (0.00045)	17.70th	v3 (v2023.03.01)
Aug 22, 2024	0.04% (0.00045)	16.38th	v3 (v2023.03.01)

Weaknesses (1)

CWE-664

References (8)

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2022-48880		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2306401		Issue Tracking
https://git.kernel.org/stable/c/50b3cdf8239b11545f311c4f7b89e0092e4feedb		Patch
https://git.kernel.org/stable/c/c965daac370f08a9b71d573a71d13cda76f2a884		Patch
https://git.kernel.org/stable/c/d2dc110deabe7142b60ebeed689e67f92795ee24		Patch
https://lore.kernel.org/linux-cve-announce/2024082107-CVE-2022-48880-ede2@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2022-48880
https://www.cve.org/CVERecord?id=CVE-2022-48880