CVE-2022-49777

Q: What is the severity of CVE-2022-49777?

CVE-2022-49777 has a CVSS score of 5.5 (MEDIUM). This CVE describes a memory leak vulnerability in the Linux kernel's i8042 keyboard/mouse controller driver. When the i8042 module is unloaded, it fails to properly destroy a platform device, causing a memory leak. This affects Linux systems using the i8042 driver for PS/2 keyboard/mouse interfaces.

5.5 MEDIUM

📋 TL;DR

This CVE describes a memory leak vulnerability in the Linux kernel's i8042 keyboard/mouse controller driver. When the i8042 module is unloaded, it fails to properly destroy a platform device, causing a memory leak. This affects Linux systems using the i8042 driver for PS/2 keyboard/mouse interfaces.

💻 Affected Systems

Products:

Linux kernel

Versions: Specific affected kernel versions not explicitly stated in CVE description, but patches exist in stable kernel trees.

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects systems using i8042 PS/2 controller driver. Modern systems with USB-only keyboards/mice may not be affected.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Sustained memory exhaustion leading to system instability or denial of service through repeated module loading/unloading attacks.

🟠

Likely Case

Minor memory leak during legitimate module operations, unlikely to cause noticeable impact in normal usage.

🟢

If Mitigated

No impact if proper kernel patching is applied or if i8042 driver is not used.

🌐 Internet-Facing: LOW - Requires local access to load/unload kernel modules.

🏢 Internal Only: LOW - Requires local privileged access (root) to exploit effectively.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: NO

Unauthenticated Exploit: ✅ No

Complexity: HIGH

Requires root privileges to load/unload kernel modules. Memory leak vulnerabilities are rarely weaponized for direct exploitation.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Patches available in stable kernel trees (commits referenced in CVE)

Vendor Advisory: https://git.kernel.org/stable/c/3f25add5ecf88de0f8ff2b27b6c0731a1f1b38ed

Restart Required: Yes

Instructions:

1. Update Linux kernel to patched version from your distribution's repositories. 2. Reboot system to load new kernel.

🔧 Temporary Workarounds

Disable i8042 module

linux

Prevent loading of vulnerable i8042 driver if PS/2 devices are not needed

echo 'blacklist i8042' >> /etc/modprobe.d/blacklist.conf

🧯 If You Can't Patch

Restrict module loading privileges to prevent unauthorized users from exploiting the memory leak
Monitor system memory usage for unusual patterns indicating potential exploitation

🔍 How to Verify

Check if Vulnerable:

Check kernel version and compare with patched versions from distribution vendor

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version after update matches patched version from vendor

📡 Detection & Monitoring

Log Indicators:

Kernel module loading/unloading logs
System memory exhaustion alerts

Network Indicators:

None - local vulnerability only

SIEM Query:

Search for repeated i8042 module load/unload events in kernel logs

📊 Metadata

CVE ID: CVE-2022-49777

CVSS v3 Score: 5.5 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-401

EPSS Score: 0.02% exploit probability (5.7th percentile)

Published: May 1, 2025

Last Updated: November 7, 2025

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Disable i8042 module

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export

🔗 Related Vulnerabilities