CVE-2022-49211: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-49211 affects the Linux kernel and involves a refcount leak in the mips_cdmm_phys_base function. The vulnerability was discovered in the MIPS CDMM (Common Device Memory Map) driver, where the of_find_compatible_node() function returns a node pointer with an incremented refcount, but the code failed to properly release this refcount using of_node_put() when done (Kernel Git).

The vulnerability exists in the drivers/bus/mips_cdmm.c file where the of_find_compatible_node() function is called to find a compatible node with "mti,mips-cdmm". The function returns a node pointer with an incremented reference count, but the code path failed to call of_node_put() to release this reference count when the operation was complete. This issue was introduced by commit 2121aa3e2312 which added MIPS CDMM DTB node support (Kernel Git).

The vulnerability results in a kernel memory leak due to unreleased reference counts. While this doesn't lead to immediate system compromise, it could potentially cause system resource exhaustion over time if the affected code path is repeatedly executed (NVD).

The vulnerability requires local access to the system and the presence of MIPS CDMM hardware. The exploitation complexity is considered low since it involves normal operation of the affected component, but the impact is limited to resource exhaustion (Ubuntu Security).

The issue has been fixed by adding the missing of_node_put(np) call after the of_address_to_resource() function call. The fix has been merged into the Linux kernel and is available through distribution-specific kernel updates (Kernel Git).