CVE-2022-49924: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-49924 is a memory leak vulnerability discovered in the Linux kernel's NFC subsystem, specifically in the fdp_nci_send() function. The vulnerability was identified and disclosed on May 1, 2025, affecting various versions of the Linux kernel from 4.4 through 6.1-rc3 (NVD).

The vulnerability occurs when fdp_nci_send() calls fdp_nci_i2c_write without properly freeing the skb (socket buffer) in the function. As a result, when fdp_nci_i2c_write() finishes execution, the skb memory leaks. The vulnerability has been assigned a CVSS v3.1 base score of 5.5 (MEDIUM) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD, Wiz).

The memory leak vulnerability can lead to resource exhaustion over time as memory is not properly freed after use. This could potentially affect system stability and performance in systems utilizing the NFC subsystem (Wiz).

The vulnerability requires local access with low privilege requirements and no user interaction. There are no known public exploits for this vulnerability, and it has an Exploitation Probability Percentile (EPSS) of 1.3 (Wiz).

The vulnerability has been addressed in the Linux kernel through a patch that ensures proper memory management by freeing the skb after fdp_nci_i2c_write() completes. Users should update their Linux kernel to a version that includes this fix (Wiz).