CVE-2022-49024: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-49024 is a memory leak vulnerability in the Linux kernel's CAN (Controller Area Network) bus implementation, specifically in the m_can PCI driver. The vulnerability was discovered in the probe/remove methods where m_can_class_free_dev() was missing, leading to potential resource leakage (CVE Details).

The vulnerability exists in the m_can_pci_remove() function and error handling path of m_can_pci_probe(), where m_can_class_free_dev() was not called to free resources allocated by m_can_class_allocate_dev(). This oversight could result in memory leaks. The issue was introduced in the commit cab7ffc0324f which added the PCI glue driver for Intel Elkhart Lake (Kernel Commit).

The vulnerability could lead to memory leaks in the Linux kernel when using the m_can PCI driver, potentially affecting system resource management over time (Debian Security).

The vulnerability has been patched in various Linux kernel versions. The fix involves adding proper resource cleanup calls in both the probe and remove methods. Fixed versions include Linux kernel 5.10.226-1 for Debian bullseye, 6.1.128-1 for bookworm, and 6.12.13-1 for sid (Debian Security).