CVE-2022-49150: 
Linux Debian vulnerability analysis and mitigation

CVE-2022-49150 is a vulnerability discovered in the Linux kernel's RTC (Real-Time Clock) driver for GameCube. The issue involves a reference count leak in the gamecube_rtc_read_offset_from_sram function. The vulnerability was disclosed and fixed in February 2025, affecting Linux kernel systems with the GameCube RTC driver (Debian Security, Ubuntu Security).

The vulnerability stems from a missing reference count release in the GameCube RTC driver. Specifically, the of_find_compatible_node() function returns a node pointer with an incremented reference count, but the code failed to call of_node_put() to release this reference count when done. This issue was introduced in commit 86559400b3ef which added the RTC driver for GameCube, Wii, and Wii U (Kernel Git).

The reference count leak could potentially lead to memory resource exhaustion over time in systems using the GameCube RTC driver, though the practical impact is limited due to the specialized nature of the affected component (Debian Security).

The vulnerability requires local access to a system running the affected GameCube RTC driver. There are no known exploits in the wild, and the issue is primarily a resource management concern rather than a direct security threat (Ubuntu Security).

The issue has been fixed by adding the missing of_node_put() call to release the reference count. The fix was committed to the Linux kernel and is available in updated versions. Users should update their systems to versions containing the fix (Kernel Git).