CVE-2022-49148

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

watch_queue: Free the page array when watch_queue is dismantled

Commit 7ea1a0124b6d ("watch_queue: Free the alloc bitmap when the

watch_queue is torn down") took care of the bitmap, but not the page

array.

BUG: memory leak

unreferenced object 0xffff88810d9bc140 (size 32):

comm "syz-executor335", pid 3603, jiffies 4294946994 (age 12.840s)

hex dump (first 32 bytes):

40 a7 40 04 00 ea ff ff 00 00 00 00 00 00 00 00 @.@.............

00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................

backtrace:

kmalloc_array include/linux/slab.h:621 [inline]

kcalloc include/linux/slab.h:652 [inline]

watch_queue_set_size+0x12f/0x2e0 kernel/watch_queue.c:251

pipe_ioctl+0x82/0x140 fs/pipe.c:632

vfs_ioctl fs/ioctl.c:51 [inline]

__do_sys_ioctl fs/ioctl.c:874 [inline]

__se_sys_ioctl fs/ioctl.c:860 [inline]

__x64_sys_ioctl+0xfc/0x140 fs/ioctl.c:860

do_syscall_x64 arch

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References