CVE-2022-49891: 
Linux Kernel vulnerability analysis and mitigation

A memory leak vulnerability (CVE-2022-49891) was identified in the Linux kernel's tracing subsystem, specifically affecting the kprobe functionality. The vulnerability was disclosed on May 1, 2025, and affects multiple versions of the Linux kernel from 5.6 through 6.0.8. This issue occurs in the test_gen_kprobe_cmd() and test_gen_kretprobe_cmd() functions where memory management is improperly handled (NVD, Wiz).

The vulnerability stems from improper memory management where the test_gen_kprobe_cmd() function only frees the allocated buffer (buf) in the failure path, causing a memory leak when the function executes successfully. The same issue exists in test_gen_kretprobe_cmd(). The leak involves an unreferenced object of size 2048 bytes, as evidenced by the hex dump showing 'p:kprobes/gen_kprobe_test do_sys'. The vulnerability has been assigned a CVSS v3.1 Base Score of 5.5 (Medium) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD).

The memory leak can lead to gradual system resource depletion over time, as the unreferenced objects of 2048 bytes accumulate in the system memory. This particularly affects processes such as 'insmod' with specific process IDs and timing characteristics (Wiz).

The vulnerability requires local access with low attack complexity and low privileges to exploit. No public exploits have been reported, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog (Wiz).

The vulnerability has been resolved by moving the kfree(buf) operation from the failure path to the common path in both affected functions, ensuring proper memory cleanup regardless of the execution path. Patches have been released for various Linux distributions, including Ubuntu 22.04 LTS (5.15.0-60.66), Ubuntu 20.04 LTS (5.15.0-1030.34~20.04.1), and other affected versions (Ubuntu).