CVE-2022-49370: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-49370 affects the Linux kernel's firmware subsystem, specifically in the dmi-sysfs component. The vulnerability was discovered in the dmisysfsregisterhandle function where kobjectinitandadd() takes a reference even when it fails. According to the documentation of kobjectinitandadd(), if this function returns an error, kobjectput() must be called to properly clean up the memory associated with the object (Kernel Git).

The vulnerability is a memory leak that occurs in the dmisysfsregisterhandle function. When kobjectinitandadd() fails, the code was using kfree(entry) instead of the required kobject_put(&entry->kobj) to clean up the memory, leading to a memory leak. This issue was introduced by commit 948af1f0bbc8 'firmware: Basic dmi-sysfs support' (Kernel Git).

The vulnerability results in a memory leak when the dmisysfsregister_handle function encounters an error condition. This can lead to gradual memory consumption over time, potentially affecting system stability and performance (NVD).

The issue has been fixed by replacing kfree(entry) with kobjectput(&entry->kobj) in the error handling path of dmisysfsregisterhandle. The fix ensures proper cleanup of memory associated with the kobject when initialization fails (Kernel Git).