CVE-2022-49276: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-49276 affects the Linux kernel's JFFS2 (Journalling Flash File System version 2) implementation. The vulnerability was discovered in the jffs2scanmedium function where a memory leak occurs if an error is returned in jffs2scaneraseblock() and memory has been added to the jffs2_summary structure. The issue was disclosed and patched in early 2022 (Kernel Git).

The vulnerability manifests when the jffs2scaneraseblock() function returns an error after allocating memory for the jffs2_summary structure. The allocated memory is not properly freed, leading to memory leaks of various sizes (64, 32, and 16 bytes) as demonstrated by kmemleak reports. The issue occurs during the mount operation when scanning the flash medium (NVD).

The memory leak can result in gradual system memory depletion over time as the affected mount operations are performed. This could potentially lead to system performance degradation or denial of service if sufficient memory is leaked (Kernel Git).

The issue has been fixed by adding a call to jffs2sumresetcollected(s) on exit to properly release the allocated memory. Additionally, a new tag "outbuf" was added to prevent NULL pointer references when s is NULL. The fix was implemented in the Linux kernel source (Kernel Git).