CVE-2022-49421: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-49421 is a vulnerability in the Linux kernel's framebuffer device (fbdev) subsystem, specifically in the CLCD (Color LCD Controller) driver. The vulnerability was discovered in the clcdfbofvram_setup function where a reference count leak occurs. The issue was publicly disclosed and fixed in 2022 (Kernel Git).

The vulnerability stems from improper reference counting in the clcdfbofvramsetup function. The ofparsephandle() function returns a node pointer with an incremented reference count, but the code failed to properly release this reference using ofnode_put() when it was no longer needed. This oversight resulted in a memory reference count leak (Kernel Git).

A reference count leak in the kernel can lead to memory resource exhaustion over time, potentially affecting system stability and performance. The issue affects the ARM CLCD framebuffer driver in the Linux kernel (NVD).

The issue has been fixed by adding proper reference count management using ofnodeput() in the error path and after successful execution. The fix was implemented in the Linux kernel through a patch that adds the missing ofnodeput() calls (Kernel Git).