CVE-2022-49881 in Linux
Summary
by MITRE • 05/01/2025
In the Linux kernel, the following vulnerability has been resolved:
wifi: cfg80211: fix memory leak in query_regdb_file()
In the function query_regdb_file() the alpha2 parameter is duplicated using kmemdup() and subsequently freed in regdb_fw_cb(). However, request_firmware_nowait() can fail without calling regdb_fw_cb() and thus leak memory.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 03/15/2026
The vulnerability identified as CVE-2022-49881 represents a memory leak in the Linux kernel's wireless subsystem, specifically within the cfg80211 configuration framework. This flaw exists in the query_regdb_file() function where the kernel attempts to handle regulatory database file operations for wireless network interfaces. The issue stems from improper memory management during firmware request processing, creating a scenario where allocated memory remains unreleased under certain error conditions. The vulnerability affects systems utilizing wireless networking capabilities and could potentially impact system stability and resource utilization over time.
The technical implementation of this vulnerability involves the improper handling of memory allocation and deallocation within the wireless regulatory database processing pipeline. When query_regdb_file() is invoked, it duplicates the alpha2 parameter using the kmemdup() function to create a copy of the regulatory domain identifier. This duplicated memory is subsequently intended to be freed by the regdb_fw_cb() callback function which executes upon successful firmware loading. However, the kernel's request_firmware_nowait() function can fail for various reasons such as file not found, permission issues, or system resource constraints without ever invoking the cleanup callback. This failure mode leaves the duplicated memory allocated in the kernel heap, creating a persistent memory leak that accumulates over time with repeated wireless regulatory database queries.
The operational impact of this vulnerability extends beyond simple memory consumption, potentially leading to system performance degradation and resource exhaustion. While individual memory leaks may appear minor, repeated occurrences during wireless network operations, particularly in systems with frequent regulatory database queries or wireless interface reconfigurations, can accumulate to significant memory pressure. This could result in reduced system responsiveness, increased swap usage, or even system instability in resource-constrained environments. The vulnerability is particularly concerning in embedded systems or devices with limited memory resources where such leaks can quickly compound and affect overall system reliability. Additionally, the leak could potentially be exploited in memory exhaustion attacks that target kernel memory pools, though direct exploitation would require additional attack vectors beyond the basic memory leak itself.
Mitigation strategies for CVE-2022-49881 should focus on applying the official kernel patches that address the memory management issue in the wireless subsystem. System administrators should prioritize updating their Linux kernel installations to versions containing the fix, which typically involves ensuring proper error handling in the firmware request processing flow. The fix implements proper memory cleanup mechanisms that ensure allocated memory is freed regardless of whether the firmware request succeeds or fails. Organizations should also consider monitoring kernel memory usage patterns and implementing automated patch management processes to prevent similar vulnerabilities from persisting in their environments. Security teams should be aware that this vulnerability aligns with CWE-401, which specifically addresses improper release of memory, and may be relevant to ATT&CK techniques related to resource exhaustion and system stability compromise. Regular kernel security audits and vulnerability assessments should include examination of wireless subsystem components to identify potential memory management issues that could lead to similar leak scenarios.