CVE-2022-49777: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-49777 is a vulnerability discovered in the Linux kernel's i8042 module, specifically related to platform device handling during module removal. The vulnerability was disclosed on May 1, 2025, affecting the Linux kernel's input subsystem (NVD, Wiz).

The vulnerability stems from a design flaw in the i8042 module's device management where the module-wide i8042_platform_device pointer is incorrectly handled during probe and remove operations. Specifically, the issue occurs when the pointer is reset in i8042_probe() or i8042_remove() functions, which prevents proper device cleanup by i8042_exit() during module unload (NVD, Wiz). The vulnerability has been assigned a CVSS v3 Base Score of 5.5 (Red Hat).

The vulnerability results in a memory leak when the i8042 module is removed, as the platform device is not properly destroyed. This can lead to resource exhaustion over time if the module is repeatedly loaded and unloaded (Wiz).

The issue has been resolved through a patch that modifies the handling of the i8042_platform_device pointer. The fix prevents resetting the pointer in i8042_probe() or i8042_remove() functions, allowing proper device cleanup during module unload (NVD).