CVE-2022-49239: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-49239 affects the Linux kernel's ASoC (ALSA System on Chip) subsystem, specifically in the WCD934X codec driver. The vulnerability was discovered in the wcd934xcodecparsedata function where a devicenode pointer returned by ofparsephandle() had its reference count incremented but was not properly released, leading to a memory leak. This issue was disclosed and fixed in February 2025 (NVD).

The vulnerability stems from a missing ofnodeput() call in the wcd934xcodecparsedata function. When the function calls ofparsephandle(), it receives a devicenode pointer with an incremented reference count. The function failed to call ofnodeput() to release this reference when done, similar to a previous issue fixed in the WCD9335 codec. The fix involves adding a single line of code to properly release the reference count (Kernel Commit).

The vulnerability results in a memory leak in the Linux kernel's audio subsystem. While memory leaks in kernel space can gradually consume system resources, the impact in this case is relatively minor as it only occurs during device initialization (NVD).

The vulnerability has been patched by adding the missing ofnodeput() call in the wcd934xcodecparse_data function. The fix has been backported to multiple stable kernel versions. Users should update their Linux kernel to a version containing the fix (Kernel Commit).