CVE-2022-48775: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-48775 is a memory leak vulnerability in the Linux kernel's Hyper-V vmbus driver, specifically in the vmbus_add_channel_kobj function. The vulnerability was discovered and disclosed on July 16, 2024, affecting Linux kernel versions from 4.15 through 5.16.11. The issue occurs when kobject_init_and_add() fails but the reference is not properly released (NVD).

The vulnerability stems from improper memory management in the vmbus_add_channel_kobj function within the Linux kernel's Hyper-V vmbus driver. When kobject_init_and_add() fails, it still takes a reference that needs to be released by calling kobject_put(). The failure to call kobject_put() in the error path results in a memory leak. The vulnerability has been assigned a CVSS v3.1 base score of 5.5 (Medium) with vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD).

The vulnerability can lead to memory leaks in the Linux kernel when running under Hyper-V, potentially causing system resource depletion over time. This could affect system availability and performance, particularly in long-running systems or those with frequent vmbus channel operations (NVD).

The vulnerability requires local access and low privileges to exploit. It is triggered through the vmbus driver's channel creation functionality when running Linux under Hyper-V. No known exploits in the wild have been reported (NVD).

The vulnerability has been fixed by adding proper memory cleanup through kobject_put() calls in the error paths. The fix has been implemented in multiple kernel versions through patches. Users should update their Linux kernel to a patched version. The fix involves adding kobject_put() calls in the appropriate error handling paths of the vmbus_add_channel_kobj function (Kernel Patch).