CVE-2022-49786: 
Linux Kernel vulnerability analysis and mitigation

In the Linux kernel, a vulnerability (CVE-2022-49786) was identified related to the block control group (blk-cgroup) functionality. The issue stems from improper parent pinning in the blkcg_css_online function. After a refactoring introduced by commit 397c9f46ee4d, the function was modified to pin the css instead of the blkcg of the parent, resulting in extra pins (Wiz).

The vulnerability exists in the blkcg_css_online function of the Linux kernel's block control group subsystem. The core issue arose when a refactoring operation changed the pinning mechanism from the parent's blkcg to the css, causing incorrect reference counting. This modification results in extra pins being created, which prevents proper cleanup of block control group resources. The vulnerability has been assigned a CVSS v3.1 base score of 5.5 with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (Red Hat).

The primary impact of this vulnerability is resource leakage, specifically of blkcgs (block control groups) and cgroups in the Linux kernel. This can lead to memory leaks, potentially affecting system performance and stability over time (Wiz).

The vulnerability has been resolved in the Linux kernel. The fix involves properly pinning the parent in the blkcg_css_online function. Users should update their Linux kernel to a patched version that includes the fix (Wiz).