CVE-2022-49813: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-49813 is a resource leak vulnerability discovered in the Linux kernel's network subsystem, specifically affecting the ena_init() function. The vulnerability was disclosed on May 1, 2025, impacting various Linux distributions and their kernel versions (NVD, Wiz).

The vulnerability exists in the error handling path of the ena_init() function within the Linux kernel's network driver. The issue occurs when the function fails to destroy a workqueue created by create_singlethread_workqueue() after pci_register_driver() fails. The vulnerability has been assigned a CVSS v3.1 base score of 7.0 with the vector string CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H (Red Hat).

The vulnerability can lead to resource leakage in the Linux kernel, potentially affecting system stability and performance over time. The exploitation probability percentile (EPSS) is reported at 4.7 (Wiz).

The vulnerability requires local access with low privileges and high attack complexity to exploit. There are no known public exploits, and it has not been listed in CISA's Known Exploited Vulnerabilities (KEV) catalog (Wiz).

The issue has been resolved by adding proper cleanup mechanism that calls destroy_workqueue() when pci_register_driver() fails. Several Linux distributions have released patches, including Ubuntu 22.04 LTS (version 5.15.0-67.74) and Red Hat Enterprise Linux systems (Ubuntu, Red Hat).