CVE-2022-49549: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-49549 is a vulnerability in the Linux kernel that involves a memory leak condition in the AMD Machine Check Exception (MCE) handling code. The issue specifically occurs when the threshold_create_bank() function fails in the x86/MCE/AMD module (NVD).

The vulnerability stems from a memory leak in the mce_threshold_create_device() function. When threshold_create_bank() fails, the previously allocated threshold banks array @bp is not properly freed. This occurs because mce_threshold_remove_device() retrieves the pointer through the threshold_banks per-CPU variable, but the pointer is only written there after successful bank creation, not before the failure occurs (Kernel Commit).

The vulnerability results in a memory leak in the Linux kernel's AMD MCE handling code, which could potentially lead to system resource depletion over time (NVD).

The issue has been resolved by adding a helper function __threshold_remove_device() that properly unwinds all bank creation work and frees the allocated threshold banks array. This fix was implemented in the Linux kernel through a patch that modifies the arch/x86/kernel/cpu/mce/amd.c file (Kernel Commit).