CVE-2022-49636: 
Linux Kernel vulnerability analysis and mitigation

In the Linux kernel, a memory leak vulnerability (CVE-2022-49636) was discovered in the VLAN (Virtual LAN) implementation. The issue occurs in the vlan_newlink() function when memory allocation fails in vlan_changelink() after other allocations have already succeeded (Kernel Git).

The vulnerability stems from a bug reintroduction that was previously fixed. When memory allocation fails for the last element in a sequence of VLAN egress QoS map configurations, the previously allocated memory is not properly freed. This occurs because after a failed ->newlink() operation, methods like ndo_uninit() or dev->priv_destructor() are not called (Kernel Git).

The vulnerability results in memory leaks in the kernel space. For example, when configuring VLAN egress QoS mappings, if the allocation for the last element fails, the memory allocated for previous successful allocations remains unreleased, leading to resource exhaustion over time (Kernel Git).

The issue can be triggered through the network configuration interface when adding VLAN devices with specific egress QoS mappings. A proof-of-concept example demonstrates the vulnerability using the command: 'ip link add link dummy0 dummy0.100 type vlan id 100 egress-qos-map 1:2 2:3 3:4 4:5 5:6 6:7 7:8 8:9 2000:2001' (Kernel Git).

The issue has been fixed by modifying the vlan_newlink() function to properly call vlan_dev_free_egress_priority() when an error occurs during vlan_changelink(). This ensures that all allocated memory is properly freed in case of failure (Kernel Git).