Not yet scoredPublished Oct 22, 2025

CVE-2022-50566mtd: Fix device name leak when register device failed in add_mtd_device()

Updated under an hour ago (Oct 27, 2026, 11:40 AM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: mtd: Fix device name leak when register device failed in add_mtd_device() There is a kmemleak when register device failed: unreferenced object 0xffff888101aab550 (size 8): comm "insmod", pid 3922, jiffies 4295277753 (age 925.408s) hex dump (first 8 bytes): 6d 74 64 30 00 88 ff ff mtd0.... backtrace: [<00000000bde26724>] __kmalloc_node_track_caller+0x4e/0x150 [<000000003c32b416>] kvasprintf+0xb0/0x130 [<000000001f7a8f15>] kobject_set_name_vargs+0x2f/0xb0 [<000000006e781163>] dev_set_name+0xab/0xe0 [<00000000e30d0c78>] add_mtd_device+0x4bb/0x700 [<00000000f3d34de7>] mtd_device_parse_register+0x2ac/0x3f0 [<00000000c0d88488>] 0xffffffffa0238457 [<00000000b40d0922>] 0xffffffffa02a008f [<0000000023d17b9d>] do_one_initcall+0x87/0x2a0 [<00000000770f6ca6>] do_init_module+0xdf/0x320 [<000000007b6768fe>] load_module+0x2f98/0x3330 [<00000000346bed5a>] __do_sys_finit_module+0x113/0x1b0 [<00000000674c2290>] do_syscall_64+0x35/0x80 [<000000004c6a8d97>] entry_SYSCALL_64_after_hwframe+0x46/0xb0 If register device failed, should call put_device() to give up the reference.

CVSS: Not yet scored
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Deferred
Record last updated: May 11, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 1f24b5a8ecbb2a3c7080f418974d40e3ffedb221 before a75f45afa932bfb24a2603ebcea5efd2e7cdcfd6; from 1f24b5a8ecbb2a3c7080f418974d40e3ffedb221 before 2302e2dc42b1f84f951c725ce742fc21c5a1e151; from 1f24b5a8ecbb2a3c7080f418974d40e3ffedb221 before db07fe76df01f40cb897d6e9066b84e46957beb3; from 1f24b5a8ecbb2a3c7080f418974d40e3ffedb221 before fa0d32ab8407d7481450c664fd0de64f2dae9489; from 1f24b5a8ecbb2a3c7080f418974d40e3ffedb221 before 330bc5533e8a8ed69cb951d5a8edce9bddb9db21; from 1f24b5a8ecbb2a3c7080f418974d40e3ffedb221 before 71212d73184845c944ef1b43f092e643e5bde003; 1f24b5a8ecbb2a3c7080f418974d40e3ffedb221 builds before 1b172fb05d6315ecec082fd7544a3390e96f0d7e; from 1f24b5a8ecbb2a3c7080f418974d40e3ffedb221 before bcabe1dc2a344adbb3382930a23e273ba9382277; and 1 more ranges	CNA record

References

References

https://git.kernel.org/stable/c/a75f45afa932bfb24a2603ebcea5efd2e7cdcfd6
https://git.kernel.org/stable/c/2302e2dc42b1f84f951c725ce742fc21c5a1e151
https://git.kernel.org/stable/c/db07fe76df01f40cb897d6e9066b84e46957beb3
https://git.kernel.org/stable/c/fa0d32ab8407d7481450c664fd0de64f2dae9489
https://git.kernel.org/stable/c/330bc5533e8a8ed69cb951d5a8edce9bddb9db21
https://git.kernel.org/stable/c/71212d73184845c944ef1b43f092e643e5bde003
https://git.kernel.org/stable/c/1b172fb05d6315ecec082fd7544a3390e96f0d7e
https://git.kernel.org/stable/c/bcabe1dc2a344adbb3382930a23e273ba9382277
https://git.kernel.org/stable/c/895d68a39481a75c680aa421546931fb11942fa6

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.