CVE-2022-49958: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-49958 is a netdevice reference leak vulnerability in the Linux kernel's traffic control (net/sched) subsystem, specifically in the attach_default_qdiscs() function. When a network device with multiple queues fails to attach a default qdisc (e.g., fq_codel) to queue 0 due to memory exhaustion, the fallback to noqueue does not properly release previously attached qdiscs on other queues, causing reference count leaks. Affected kernel versions include 5.8.x through 5.10.141, 5.11.x through 5.15.65, 5.16.x through 5.19.7, and 6.0 release candidates (rc1–rc3). It was publicly disclosed on June 18, 2025, and carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly, Kernel Patches).

The root cause is improper resource management (CWE-401: Missing Release of Memory after Effective Lifetime) in attach_default_qdiscs() within the Linux kernel's net/sched subsystem. When a multi-queue network device is activated and queue 0 fails to attach a default qdisc due to memory pressure in attach_one_default_qdisc(), the kernel falls back to noqueue but does not release qdiscs that were successfully attached to other queues before the failure. This results in inflated reference counts on the netdevice, as demonstrated by the kernel log message unregister_netdevice: waiting for veth0 to become free. Usage count = 32. The fix clears any non-noop qdiscs assigned to queues before attempting re-attachment during the fallback path (Feedly, Kernel Patches).

Successful exploitation can cause memory leaks and render network devices unable to be unregistered, as their reference counts remain artificially elevated. This leads to a local denial-of-service condition where affected network interfaces become unresponsive or stuck, potentially disrupting network connectivity on the host. There is no confidentiality or integrity impact; the vulnerability is limited to availability (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation for CVE-2022-49958. Exploitation requires local access with low privileges (e.g., the ability to create and configure network devices with multiple queues under memory pressure). The EPSS score is approximately 0.018%, reflecting very low likelihood of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (Feedly).

• Logs: Kernel log messages such as <ifname>: default qdisc (fq_codel) fail, fallback to noqueue followed by unregister_netdevice: waiting for <ifname> to become free. Usage count = <high_number> in /var/log/kern.log or dmesg output.
• Process/System: Network interfaces that cannot be removed or unregistered despite being administratively down; ip link delete or similar commands hanging indefinitely.
• File System: Kernel stack traces referencing qdisc_alloc, qdisc_create_dflt, attach_one_default_qdisc, and dev_activate in kernel crash dumps or oops logs (Feedly).

Update the Linux kernel to a patched version: 5.10.142 or later (for 5.10.x branch), 5.15.66 or later (for 5.15.x branch), or 5.19.8 or later (for 5.16.x–5.19.x branch). Patches are available from the Linux kernel stable tree at git.kernel.org. As a temporary workaround, avoid creating multi-queue network devices under low-memory conditions, and monitor system logs for reference count anomalies. SUSE has also issued kernel security advisories incorporating this fix (Feedly, SUSE Advisory).

SUSE issued multiple kernel security advisories (SUSE-2025:02264-1, SUSE-2025:02537-1) that include fixes for this vulnerability, indicating it was prioritized in enterprise Linux distributions. Tenable's Nessus and Qualys scanners have added detection plugins for this CVE. No notable independent researcher commentary or significant social media discussion has been identified (SUSE Advisory, Tenable Plugin).