CVE-2022-49878: 
Linux Kernel vulnerability analysis and mitigation

A memory leak vulnerability was discovered in the Linux kernel's BPF verifier component (CVE-2022-49878). The issue occurs when krealloc() returns NULL during array reallocation for stack state, where callers of realloc_array() were incorrectly setting their allocation pointers to NULL while krealloc() maintains the original allocation. This vulnerability affects Linux kernel versions from 5.14 up to 6.1.rc4 (NVD).

The vulnerability specifically affects the BPF verifier's array reallocation functionality for stack state. When krealloc() returns NULL indicating an error, the callers of realloc_array() were erroneously setting their allocation pointers to NULL. However, krealloc() does not modify the original allocation on error, leading to a memory leak. The issue has a CVSS v3.1 base score of 5.5 (MEDIUM) with vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD, Wiz).

The vulnerability results in a memory resource leak in the Linux kernel. While this may not lead to immediate system compromise, continuous memory leaks can degrade system performance and potentially lead to resource exhaustion over time (NVD, Wiz).

The vulnerability requires local access with low complexity and low privileges to exploit. No user interaction is needed. There are no known public exploits for this vulnerability (Wiz).

The vulnerability has been fixed in the Linux kernel through a patch that properly handles the error case by freeing the old allocation on the error handling path (NVD).