CVE-2022-49211: 
Linux Debian vulnerability analysis and mitigation

CVE-2022-49211 affects the Linux kernel and involves a refcount leak in the mipscdmmphysbase function. The vulnerability was discovered in the MIPS CDMM (Common Device Memory Map) driver, where the offindcompatiblenode() function returns a node pointer with an incremented refcount, but the code failed to properly release this refcount using ofnodeput() when done (Kernel Git).

The vulnerability exists in the drivers/bus/mipscdmm.c file where the offindcompatiblenode() function is called to find a compatible node with "mti,mips-cdmm". The function returns a node pointer with an incremented reference count, but the code path failed to call ofnodeput() to release this reference count when the operation was complete. This issue was introduced by commit 2121aa3e2312 which added MIPS CDMM DTB node support (Kernel Git).

The vulnerability results in a kernel memory leak due to unreleased reference counts. While this doesn't lead to immediate system compromise, it could potentially cause system resource exhaustion over time if the affected code path is repeatedly executed (NVD).

The issue has been fixed by adding the missing ofnodeput(np) call after the ofaddressto_resource() function call. The fix has been merged into the Linux kernel and is available through distribution-specific kernel updates (Kernel Git).