CVE-2022-49008: 
Linux Debian vulnerability analysis and mitigation

In the Linux kernel, a vulnerability (CVE-2022-49008) was identified in the CAN (Controller Area Network) subsystem, specifically in the can327 driver. The issue involves a potential socket buffer (skb) leak in the can327feedframetonetdev() function when the network device is down. This vulnerability affects Linux kernel versions from 6.0 up to (excluding) 6.0.12, and various 6.1 release candidates (rc1 through rc7) (NVD).

The vulnerability stems from the can327feedframetonetdev() function not properly freeing the socket buffer (skb) when the network device is down. Additionally, all callers of can327feedframetonetdev() failed to free allocated skb, resulting in a memory leak. The issue has been assigned a CVSS v3.1 Base Score of 5.5 MEDIUM (Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) (NVD).

The vulnerability can lead to memory leaks in the kernel when the network device is down, potentially causing system resource exhaustion over time. This could affect system stability and performance, particularly in long-running systems or those frequently transitioning network states (NVD).

The issue has been fixed by adding kfreeskb() in can327feedframeto_netdev() when the network device is down. The fix was implemented in the kernel patch and is available in updated kernel versions. Users should upgrade to Linux kernel version 6.0.12 or later to address this vulnerability (Kernel Patch).