CVE-2022-49890: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-49890 is a vulnerability discovered in the Linux kernel's capabilities subsystem, disclosed on May 1, 2025. The vulnerability affects various versions of the Linux kernel from version 5.5 up to versions 5.10.154, 5.15.78, and 6.1 release candidates (NVD).

The vulnerability occurs in the cap_inode_getsecurity() function where a potential memory leak exists in the error handling path from vfs_getxattr_alloc(). When memory allocation for tmpbuf is completed but the handler->get() call fails, a memory leak occurs in the subsequent logic. The vulnerability has been assigned a CVSS v3.1 base score of 5.5 (MEDIUM), with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD, Wiz).

The primary impact of this vulnerability is a memory leak in the Linux kernel that could lead to resource exhaustion over time. While the vulnerability does not allow for arbitrary code execution or privilege escalation, it could potentially affect system stability and performance through memory depletion (Wiz).

The vulnerability requires local access with low complexity and low privileges to exploit. No user interaction is required for exploitation. There are no known public exploits for this vulnerability at the time of assessment (NVD).

The vulnerability has been fixed in the Linux kernel by adding proper cleanup of tmpbuf after vfs_getxattr_alloc() fails. Red Hat has marked this as 'Fix deferred' for Red Hat Enterprise Linux 9 and kernel-rt packages (Red Hat).