CVE-2022-49362: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-49362 is a use-after-free vulnerability discovered in the Linux kernel's NFSD (Network File System daemon) component. The vulnerability specifically affects the nfsd_file_put() function, where nfsd_file_put_noref() can free @nf, leading to a potential dereference of the freed pointer immediately after the function call (Kernel Git).

The vulnerability stems from a code flow issue in the nfsd_file_put() function where the @nf pointer could be dereferenced after being freed by nfsd_file_put_noref(). The issue was introduced by commit 999397926ab3 ("nfsd: Clean up nfsd_file_put()"). The vulnerability has been assigned a CVSS v3.1 Base Score of 7.8 (HIGH) with vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (NVD).

The vulnerability could lead to a use-after-free condition in the Linux kernel's NFSD component, potentially resulting in system crashes, information disclosure, or privilege escalation. The high CVSS score indicates significant potential impact on system confidentiality, integrity, and availability (NVD).

The vulnerability requires local access with low privileges to exploit. The attack complexity is rated as low, indicating that the vulnerability is relatively straightforward to exploit under the right conditions (NVD).

The vulnerability has been patched in the Linux kernel. The fix involves restructuring the code flow in nfsd_file_put() to ensure that @nf is not dereferenced after being freed by nfsd_file_put_noref(). The patch was authored by Chuck Lever and has been backported to various stable kernel versions (Kernel Git).