CVE-2022-49421: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-49421 is a vulnerability in the Linux kernel's framebuffer device (fbdev) subsystem, specifically in the CLCD (Color LCD Controller) driver. The vulnerability was discovered in the clcdfb_of_vram_setup function where a reference count leak occurs. The issue was publicly disclosed and fixed in 2022 (Kernel Git).

The vulnerability stems from improper reference counting in the clcdfb_of_vram_setup function. The of_parse_phandle() function returns a node pointer with an incremented reference count, but the code failed to properly release this reference using of_node_put() when it was no longer needed. This oversight resulted in a memory reference count leak (Kernel Git).

A reference count leak in the kernel can lead to memory resource exhaustion over time, potentially affecting system stability and performance. The issue affects the ARM CLCD framebuffer driver in the Linux kernel (NVD).

The vulnerability requires local access to a system using the affected CLCD framebuffer driver. There are no known reports of this vulnerability being exploited in the wild (NVD).

The issue has been fixed by adding proper reference count management using of_node_put() in the error path and after successful execution. The fix was implemented in the Linux kernel through a patch that adds the missing of_node_put() calls (Kernel Git).