CVE-2022-49819: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-49819 affects the Linux kernel, specifically related to a potential memory leak in the octeon_ep driver's octep_device_setup() function. The vulnerability was discovered when unsupported_dev and mbox init errors occurred, where the code failed to properly free oct->conf and iounmap() oct->mmio[i].hw_addr resources (NVD, Wiz).

The vulnerability exists in the octeon_ep driver implementation where memory resources are not properly freed during error conditions. Specifically, when unsupported_dev and mbox initialization errors occur, the code path fails to execute kfree() for oct->conf and iounmap() for oct->mmio[i].hw_addr, leading to memory leaks. The issue has been assigned a CVSS v3.1 Base Score of 5.5 by Red Hat, indicating moderate severity (Red Hat).

The vulnerability results in memory leaks in the Linux kernel when certain error conditions occur in the octeon_ep driver. This can lead to gradual system resource depletion over time (Wiz).

The issue has been resolved by adding proper cleanup code. The fix includes implementing kfree() for oct->conf and iounmap() for oct->mmio[i].hw_addr under unsupported_dev and mbox init error conditions (Wiz).