CVE-2022-49397: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-49397 affects the Linux kernel's phy-qcom-qmp driver. The vulnerability involves a struct clk leak that occurs during probe errors in the Qualcomm QMP PHY driver. The issue was discovered and fixed in 2022, with the vulnerability being related to improper resource management when probe errors occur (Kernel Git).

The vulnerability stems from improper handling of pipe clock references during probe errors. Specifically, when a late probe error occurs (such as probe deferral), the pipe clock reference is not properly released. The fix involves replacing the of_clk_get_by_name() call with devm_get_clk_from_child() to ensure proper resource management (Kernel Git).

The vulnerability results in a memory leak (struct clk leak) when probe errors occur in the QMP PHY driver. While this doesn't present immediate security risks, it can lead to resource exhaustion over time if the error condition is triggered repeatedly (NVD).

The issue has been resolved by modifying the driver to use devm_get_clk_from_child() instead of of_clk_get_by_name(), ensuring proper cleanup of clock resources during error conditions. The fix was implemented in the Linux kernel and backported to affected stable kernel versions (Kernel Git).