CVE-2022-49286: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-49286 affects the Linux kernel's TPM (Trusted Platform Module) implementation. The vulnerability was discovered in the tpm2delspace() function where a race condition could occur during TPM operations. This issue was introduced during a series of changes to remove nested TPM operations, where the exposure of the chip->tpm_mutex was removed from upper level code (Kernel Git).

The vulnerability stems from a missed conversion in tpm2delspace() function during the removal of nested TPM operations. While the function is typically called closely after a converted operation, there exists a small race window where the chip can be removed before space flushing is completed, resulting in a NULL dereference on the mutex (Kernel Git).

When exploited, this vulnerability can cause a NULL pointer dereference on the mutex, potentially leading to system crashes or denial of service conditions (NVD).

The issue has been patched by converting tpm2delspace() to use tpmtryget_ops(), which performs all teardown checks before acquiring the mutex. The fix has been implemented in the Linux kernel through a series of patches (Kernel Git).