CVE-2022-28390: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-28390 is a double free vulnerability discovered in the emsusbstartxmit function in drivers/net/can/usb/emsusb.c of the Linux kernel through version 5.17.1. The vulnerability affects the EMS CPC-USB/ARM7 CAN/USB interface driver (NVD, Debian Security).

The vulnerability is classified as a double free flaw in the emsusbstartxmit function, where devkfreeskb() is called unnecessarily when usbsubmiturb() fails, as canputechoskb() already deletes the original skb and canfreeecho_skb() deletes the cloned skb (Linux Commit). The vulnerability has been assigned a CVSS v3.1 Base Score of 7.8 (HIGH) with vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (NVD).

When successfully exploited, this vulnerability could lead to disclosure of sensitive information, addition or modification of data, or Denial of Service (DoS). The vulnerability requires local access to the system (NetApp Advisory).

The vulnerability has been fixed in multiple Linux distributions. Debian has addressed it in version 5.10.113-1 for the stable distribution (bullseye) (Debian Security). Fedora has released fixes in kernel versions 5.16.19-200.fc35, 5.17.2-300.fc36, and 5.16.19-100.fc34 (Fedora Updates).