CVE-2022-49351: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-49351 affects the Linux kernel's Altera TSE (Triple-Speed Ethernet) driver. The vulnerability was discovered in the alteratsemdio_create function where a reference count leak occurs during the handling of device tree nodes. The issue was disclosed and fixed in 2022, affecting the Linux kernel's networking subsystem (Kernel Git).

The vulnerability stems from improper reference counting in the foreachchildofnode() loop within the alteratsemdiocreate function. Every iteration of this loop decrements the reference count of the previous node, but when breaking from the loop, the code failed to explicitly call ofnode_put() on the child node when no longer needed. This oversight leads to a reference count leak (Kernel Git).

A reference count leak in the kernel's memory management can lead to memory resource exhaustion over time, potentially affecting system stability and performance (NVD).

The issue has been fixed by adding the missing ofnodeput() call to properly manage node reference counts. The fix was implemented in the Linux kernel through a patch that adds proper reference counting cleanup in the alteratsemdio_create function (Kernel Git).