CVE-2022-49665: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-49665 affects the Linux kernel's ThinkPad ACPI driver. The vulnerability was discovered in the platform/x86 ThinkPad ACPI component, specifically related to a memory leak in the EFCH MMIO resource handling. The issue was disclosed and patched in February 2025, affecting the ThinkPad ACPI driver implementation (Kernel Git, NVD).

The vulnerability stems from improper resource cleanup in the ThinkPad ACPI driver. Unlike releasememregion(), a call to releaseresource() does not free the resource automatically, requiring explicit deallocation. The bug was introduced in commit 455cd867b85b which added an s2idle resume quirk for certain laptop models. The fix involves adding an explicit kfree(res) call after releaseresource(res) to properly deallocate the memory (Kernel Git).

The vulnerability results in a memory leak in the kernel space when handling EFCH MMIO resources in affected ThinkPad systems. While the impact is relatively minor, continuous memory leaks could potentially lead to system resource exhaustion over time (Ubuntu Security).

The vulnerability has been patched in the Linux kernel. System administrators should update to patched kernel versions that include the fix. The patch adds proper resource cleanup by explicitly freeing the resource after release_resource() is called (Kernel Git).