CVE-2022-24959: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-24959 is a vulnerability discovered in the Linux kernel before version 5.16.5, specifically affecting the YAM AX.25 device driver. The issue involves a memory leak in the yam_siocdevprivate function in drivers/net/hamradio/yam.c, which was disclosed on February 11, 2022 (MITRE).

The vulnerability stems from a failure to properly deallocate memory in certain error conditions within the YAM AX.25 device driver. Specifically, the memory leak occurs when ym needs to be freed when ym->cmd != SIOCYAMSMCS (Linux Commit). The issue has been assigned a CVSS 3 Severity Score of 5.5 (Medium) (Ubuntu).

The memory leak vulnerability could result in kernel memory exhaustion, potentially leading to a denial of service condition. A local privileged attacker could exploit this vulnerability to cause system instability (Debian).

The vulnerability requires local access and privileged user permissions to exploit. There are no known public exploits targeting this vulnerability in the wild.

The vulnerability has been fixed in Linux kernel version 5.16.5 and later. Various Linux distributions have released patches to address this issue, including Ubuntu (fixed in multiple versions including 5.13.0-40.45 for 21.10), Debian (fixed in version 5.10.92-2 for bullseye), and other distributions (Debian, Ubuntu).