---
id: CVE-2022-49190
title: 'kernel/resource: fix kfree() of bootmem memory again'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  kernel/resource: fix kfree() of bootmem memory again

  Since commit ebff7d8f270d ("mem hotunplug: fix kfree() of bootmem
  memory"), we could get a resource allocated duri…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= ebff7d8f270d045338d9f4796014f4db429a17f9 <
    3379a60f6bb4afcd9c456e340ac525ae649d3ce7
  - >-
    Linux >= ebff7d8f270d045338d9f4796014f4db429a17f9 <
    a9e88c2618d228d7a4e7e515cf30dc0d0d813f27
  - >-
    Linux >= ebff7d8f270d045338d9f4796014f4db429a17f9 <
    d7faa04a44a0c37ac3d222fa8e0bdcbfcee9c0c8
  - >-
    Linux >= ebff7d8f270d045338d9f4796014f4db429a17f9 <
    ab86020070999e758ce2e60c4348f20bf7ddba56
  - >-
    Linux >= ebff7d8f270d045338d9f4796014f4db429a17f9 <
    0cbcc92917c5de80f15c24d033566539ad696892
  - Linux 3.10
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T19:44:23.543113Z'
published: '2025-02-26'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T19:49:36.987Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2022-49190'
references:
  - url: 'https://git.kernel.org/stable/c/3379a60f6bb4afcd9c456e340ac525ae649d3ce7'
  - url: 'https://git.kernel.org/stable/c/a9e88c2618d228d7a4e7e515cf30dc0d0d813f27'
  - url: 'https://git.kernel.org/stable/c/d7faa04a44a0c37ac3d222fa8e0bdcbfcee9c0c8'
  - url: 'https://git.kernel.org/stable/c/ab86020070999e758ce2e60c4348f20bf7ddba56'
  - url: 'https://git.kernel.org/stable/c/0cbcc92917c5de80f15c24d033566539ad696892'
tags:
  - cve.org
epss: 0.00266
epssPercentile: 0.18578
ingestedAt: '2026-11-05T22:38:31.564Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

kernel/resource: fix kfree() of bootmem memory again

Since commit ebff7d8f270d ("mem hotunplug: fix kfree() of bootmem
memory"), we could get a resource allocated during boot via
alloc_resource().  And it's required to release the resource using
free_resource().  Howerver, many people use kfree directly which will
result in kernel BUG.  In order to fix this without fixing every call
site, just leak a couple of bytes in such corner case.

## Affected

- `Linux >= ebff7d8f270d045338d9f4796014f4db429a17f9 < 3379a60f6bb4afcd9c456e340ac525ae649d3ce7`
- `Linux >= ebff7d8f270d045338d9f4796014f4db429a17f9 < a9e88c2618d228d7a4e7e515cf30dc0d0d813f27`
- `Linux >= ebff7d8f270d045338d9f4796014f4db429a17f9 < d7faa04a44a0c37ac3d222fa8e0bdcbfcee9c0c8`
- `Linux >= ebff7d8f270d045338d9f4796014f4db429a17f9 < ab86020070999e758ce2e60c4348f20bf7ddba56`
- `Linux >= ebff7d8f270d045338d9f4796014f4db429a17f9 < 0cbcc92917c5de80f15c24d033566539ad696892`
- `Linux 3.10`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.