CVE-2022-49958: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-49958 is a vulnerability in the Linux kernel related to netdevice reference leaks in the attach_default_qdiscs() function. The vulnerability was disclosed and documented in June 2025 (NVD, Wiz).

The vulnerability occurs in attach_default_qdiscs() when a device has multiple queues and queue 0 fails to attach qdisc due to memory constraints in attach_one_default_qdisc(). In this scenario, dev->qdisc defaults to noop_qdisc, but other queues may successfully attach to the default qdisc. This triggers the fallback to noqueue process, and if the original attached qdisc is not released before attaching a new one, it results in netdevice reference leaks (NVD, Wiz).

The vulnerability can lead to resource leaks in the system, specifically netdevice reference leaks. This is evidenced by the bug log showing a waiting state for veth0 with a usage count of 32 leaked references (Wiz).

The fix involves clearing any non-noop qdiscs that may have been assigned before attempting to re-attach. This solution has been implemented in the Linux kernel to prevent the reference leaks (Wiz).