CVE-2022-49402: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-49402 affects the Linux kernel's ftrace functionality, specifically related to the cleanup of hash direct_functions on register failures. The vulnerability was discovered when a general protection fault (GPF) occurs during register_ftrace_direct failures, caused by an entry being added to direct_functions but not properly removed upon failure (Kernel Git).

The vulnerability manifests as a general protection fault for non-canonical address 0x200000000000010 when register_ftrace_direct fails. The issue occurs in the ftrace_find_rec_direct function and can be triggered through a specific sequence of operations involving livepatches and BPF tracing. The bug is caused by improper cleanup of entries in the direct_functions hash when registration fails (Kernel Git).

When exploited, this vulnerability can lead to a kernel general protection fault, potentially causing system crashes. This is particularly impactful when working with kernel function tracing and BPF programs, affecting system stability and reliability (Kernel Git).

The vulnerability can be triggered through a specific sequence of steps: 1) loading a livepatch that patches a kernel function, 2) running bpftrace with kfunc tracing on the patched function (which fails), and 3) repeating the bpftrace operation, which leads to the GPF (Kernel Git).

The issue has been fixed by properly removing the entry from direct_functions when register_ftrace_direct fails. The fix involves moving the cleanup code to ensure proper entry removal during failure conditions (Kernel Git).