From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 02C1E2FE05C for ; Wed, 22 Oct 2025 13:25:21 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1761139522; cv=none; b=lxkbEC2BZMZV9O99fV79ts8ntmZJ4potVi2AS5szwAYQ1nqgu2FbR9TZ+xGRj8cXNDIVttsvNUInzAQH484KuwCOKOGVQ1IqE8kYUa2M4jVnDwv1C534qD7okGTx4p6zhqS82c1bRgfwJ1tSYVYT2x/nERkmCNjrDrqpogay3yc= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1761139522; c=relaxed/simple; bh=3qPhoDRZN+lRLWu13UdgfmMPZucUF96UCwdAz711ZnE=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=NLlL2bzYymy241HxdgI1vYF25r6GtAo3Vf/z+Dz2ITg7Tm7QIKAGdp5zHKuBX4sltHpvyxfoVd8Yc5rW8yNgp8gqAnSoDiqmUqQC7JLyYSK4sqpWO+CA8aPII1Js4niR9dyKFdV+SojmBtIR5zBsXXaz7/0PYq+/fNslWH3/S6E= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=bZvwD599; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="bZvwD599" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 84460C4CEE7; Wed, 22 Oct 2025 13:25:21 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1761139521; bh=3qPhoDRZN+lRLWu13UdgfmMPZucUF96UCwdAz711ZnE=; h=From:To:Cc:Subject:Date:Reply-to:From; b=bZvwD599RkGdZu9BIcebUgoQXrr8UrWJhEC9kvBKRN3RXJnMFZuR3li8pZL642F50 d1EcG22JdRQ4gXK5/msNwDPjXLJ+EjNyMQnSqas/e3qVsGJnBHJnJL/zbWOB1ElsSv 9kwhLlX9BFqiS4O9iPuodD/5D+/PpYpZvezOAWfU= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2022-50559: clk: imx: scu: fix memleak on platform_device_add() fails Date: Wed, 22 Oct 2025 15:24:07 +0200 Message-ID: <2025102206-CVE-2022-50559-e162@gregkh> X-Mailer: git-send-email 2.51.1 Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Reply-to: , X-Developer-Signature: v=1; a=openpgp-sha256; l=2355; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=0szFsGDFra93U+A+b8iIpoZBixsziOLrRxYqkQEmh0s=; b=owGbwMvMwCRo6H6F97bub03G02pJDBk/bn3reGxne/Jcxu2W7Yl/vxf2yUw1CeO9yD/p1sHiu u9cJ3j9OmJZGASZGGTFFFm+bOM5ur/ikKKXoe1pmDmsTCBDGLg4BWAiWukMC07MZZ6hrTWzKrZr GptciUznzLj+wwzz3Z+EB60KDdi7sOATW8mEo89mHT8mCwA= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: clk: imx: scu: fix memleak on platform_device_add() fails No error handling is performed when platform_device_add() fails. Add error processing before return, and modified the return value. The Linux kernel CVE team has assigned CVE-2022-50559 to this issue. Affected and fixed versions =========================== Issue introduced in 5.11 with commit 77d8f3068c63ee0983f0b5ba3207d3f7cce11be4 and fixed in 5.15.75 with commit 9209e6bab75d4008d9f4248c66008f3ffd24c931 Issue introduced in 5.11 with commit 77d8f3068c63ee0983f0b5ba3207d3f7cce11be4 and fixed in 5.19.17 with commit 43c589b7a187ef481b594317eaab8c8f269e4a68 Issue introduced in 5.11 with commit 77d8f3068c63ee0983f0b5ba3207d3f7cce11be4 and fixed in 6.0.3 with commit 05fe0b3d69b8e094db207648ab21cade56d71cd8 Issue introduced in 5.11 with commit 77d8f3068c63ee0983f0b5ba3207d3f7cce11be4 and fixed in 6.1 with commit 855ae87a2073ebf1b395e020de54fdf9ce7d166f Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2022-50559 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/clk/imx/clk-scu.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/9209e6bab75d4008d9f4248c66008f3ffd24c931 https://git.kernel.org/stable/c/43c589b7a187ef481b594317eaab8c8f269e4a68 https://git.kernel.org/stable/c/05fe0b3d69b8e094db207648ab21cade56d71cd8 https://git.kernel.org/stable/c/855ae87a2073ebf1b395e020de54fdf9ce7d166f