CVE-2022-49370: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-49370 affects the Linux kernel's firmware subsystem, specifically in the dmi-sysfs component. The vulnerability was discovered in the dmi_sysfs_register_handle function where kobject_init_and_add() takes a reference even when it fails. According to the documentation of kobject_init_and_add(), if this function returns an error, kobject_put() must be called to properly clean up the memory associated with the object (Kernel Git).

The vulnerability is a memory leak that occurs in the dmi_sysfs_register_handle function. When kobject_init_and_add() fails, the code was using kfree(entry) instead of the required kobject_put(&entry->kobj) to clean up the memory, leading to a memory leak. This issue was introduced by commit 948af1f0bbc8 'firmware: Basic dmi-sysfs support' (Kernel Git).

The vulnerability results in a memory leak when the dmi_sysfs_register_handle function encounters an error condition. This can lead to gradual memory consumption over time, potentially affecting system stability and performance (NVD).

The issue has been fixed by replacing kfree(entry) with kobject_put(&entry->kobj) in the error handling path of dmi_sysfs_register_handle. The fix ensures proper cleanup of memory associated with the kobject when initialization fails (Kernel Git).