CVE-2022-49386: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-49386 is a vulnerability in the Linux kernel's networking subsystem, specifically affecting the Texas Instruments AM65 CPSW NUSS Ethernet driver. The vulnerability was disclosed and patched in 2022, involving reference count leaks in the am65-cpsw-nuss driver. The issue affects the Linux kernel's handling of device tree nodes in the ethernet subsystem (NVD).

The vulnerability stems from improper reference counting in the AM65 CPSW NUSS driver. The of_get_child_by_name() function returns a node pointer with an incremented reference count, but the code failed to properly release this reference count in error cases within the am65_cpsw_init_cpts() and am65_cpsw_nuss_probe() functions. This oversight could lead to reference count leaks (Kernel Commit). The vulnerability has been assigned a CVSS v3.1 base score of 5.5, indicating moderate severity (Red Hat).

The impact of this vulnerability is primarily related to system resource management. A reference count leak could potentially lead to resource exhaustion over time, though the practical impact is limited. The vulnerability affects the kernel's memory management but does not directly expose the system to unauthorized access or data compromise (Red Hat).

The vulnerability requires local access and has low attack complexity. The attack vector is local (AV:L), with low attack complexity (AC:L) and requires low privileges (PR:L). There is no user interaction required (UI:N) for exploitation (Red Hat).

The vulnerability has been fixed by adding proper reference count management using of_node_put() in the affected code paths. The fix was implemented in the Linux kernel through a patch that ensures proper release of reference counts in error cases (Kernel Commit). Users should update their kernel to a version containing this fix.