CVE-2022-49239: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-49239 affects the Linux kernel's ASoC (ALSA System on Chip) subsystem, specifically in the WCD934X codec driver. The vulnerability was discovered in the wcd934x_codec_parse_data function where a device_node pointer returned by of_parse_phandle() had its reference count incremented but was not properly released, leading to a memory leak. This issue was disclosed and fixed in February 2025 (NVD).

The vulnerability stems from a missing of_node_put() call in the wcd934x_codec_parse_data function. When the function calls of_parse_phandle(), it receives a device_node pointer with an incremented reference count. The function failed to call of_node_put() to release this reference when done, similar to a previous issue fixed in the WCD9335 codec. The fix involves adding a single line of code to properly release the reference count (Kernel Commit).

The vulnerability results in a memory leak in the Linux kernel's audio subsystem. While memory leaks in kernel space can gradually consume system resources, the impact in this case is relatively minor as it only occurs during device initialization (NVD).

The vulnerability has been patched by adding the missing of_node_put() call in the wcd934x_codec_parse_data function. The fix has been backported to multiple stable kernel versions. Users should update their Linux kernel to a version containing the fix (Kernel Commit).