CVE-2022-49150: 
Linux Debian vulnerability analysis and mitigation

CVE-2022-49150 is a vulnerability discovered in the Linux kernel's RTC (Real-Time Clock) driver for GameCube. The issue involves a reference count leak in the gamecubertcreadoffsetfrom_sram function. The vulnerability was disclosed and fixed in February 2025, affecting Linux kernel systems with the GameCube RTC driver (Debian Security, Ubuntu Security).

The vulnerability stems from a missing reference count release in the GameCube RTC driver. Specifically, the offindcompatiblenode() function returns a node pointer with an incremented reference count, but the code failed to call ofnode_put() to release this reference count when done. This issue was introduced in commit 86559400b3ef which added the RTC driver for GameCube, Wii, and Wii U (Kernel Git).

The reference count leak could potentially lead to memory resource exhaustion over time in systems using the GameCube RTC driver, though the practical impact is limited due to the specialized nature of the affected component (Debian Security).

The issue has been fixed by adding the missing ofnodeput() call to release the reference count. The fix was committed to the Linux kernel and is available in updated versions. Users should update their systems to versions containing the fix (Kernel Git).