CVE-2022-49994: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-49994 is a memory management vulnerability in the Linux kernel involving improper handling of vmemmap pages within the put_page_bootmem function. The flaw causes kmemleak — the kernel's memory leak detection subsystem — to malfunction when vmemmap pages are freed and reused without being properly deregistered from kmemleak's tracking. Affected versions include Linux kernel 5.14.x up to (but not including) 5.15.64, 5.16.x up to (but not including) 5.19.6, and 6.0-rc1 and 6.0-rc2. It carries a CVSS v3.1 base score of 5.5 (Medium), requiring only local low-privileged access with no user interaction (Feedly).

The root cause is classified as CWE-401 (Missing Release of Memory after Effective Lifetime). When bootmem allocates vmemmap pages from memblock, kmemleak marks them for tracking. However, when put_page_bootmem frees these pages, it fails to call the appropriate kmemleak removal function, leaving stale tracking entries. When the freed pages are subsequently reused, kmemleak detects an overlap with an existing tracked object and logs Cannot insert <addr> into the object search tree (overlaps existing), ultimately disabling itself. The fix involves calling kmemleak_free on vmemmap pages during put_page_bootmem to properly deregister them before reuse (Feedly, Kernel Patch 1).

Successful exploitation by a local low-privileged attacker can cause the kernel's kmemleak memory leak detector to become permanently disabled for the duration of the system's uptime. This is primarily an availability impact against the diagnostic subsystem — it does not directly expose sensitive data or allow privilege escalation, but disabling kmemleak can mask other memory-related kernel bugs, potentially allowing undetected memory leaks to degrade system stability over time. There is no confidentiality or integrity impact (Feedly).

There is no known public proof-of-concept exploit for CVE-2022-49994, and no evidence of in-the-wild exploitation has been observed. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.017%, reflecting a very low probability of exploitation in the near term (Feedly).

• Logs: Kernel log (dmesg or /var/log/kern.log) entries containing kmemleak: Cannot insert <address> into the object search tree (overlaps existing) followed by kmemleak: Kernel memory leak detector disabled.
• Kernel State: The file /sys/kernel/debug/kmemleak becomes unresponsive or reports that the detector has been disabled, indicating the subsystem was triggered into a fault state.

Patches have been released for the affected Linux kernel stable branches. Administrators should update to kernel version 5.15.64 or later (for the 5.15.x series), 5.19.6 or later (for the 5.16.x–5.19.x series), or any stable release beyond 6.0-rc2. The fixes are available in the upstream kernel stable tree. As a workaround, limiting local user access to affected systems reduces the attack surface, though upgrading to a patched kernel is the recommended remediation (Kernel Patch 1, Kernel Patch 2, Kernel Patch 3).