CVE-2022-49775: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-49775 affects the Linux kernel's TCP CDG (CAIA Delay-Gradient) congestion control implementation. The vulnerability was discovered when it was found that MPTCP (Multipath TCP) could call tcp_disconnect() on an already disconnected flow, which could trigger a double-free condition when using CDG congestion control (NVD).

The vulnerability exists in the tcpcdgrelease() function which could be called multiple times due to MPTCP's ability to call tcp_disconnect() on an already disconnected flow. This specifically affects systems using CDG congestion control, where a double-free condition could occur in the slab memory allocator. The issue manifests in the kernel's memory management subsystem, specifically in mm/slub.c (NVD, Wiz).

When exploited, this vulnerability could lead to a double-free condition in the kernel's memory management system. This type of memory corruption could potentially result in system crashes or other undefined behavior, affecting system stability and potentially leading to privilege escalation (Wiz).

The vulnerability has been addressed by making tcpdisconnect() more resilient rather than fixing MPTCP specifically. This approach prevents both this issue and potential future similar bugs. The fix allows tcpcdg_release() to be safely called multiple times (Wiz).