CVE-2022-49438: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-49438 affects the Linux kernel's sparcspkr driver. The vulnerability is a reference count leak in the bbc_beep_probe function where of_find_node_by_path() calls of_find_node_opts_by_path() which returns a node pointer with refcount incremented, but fails to use of_node_put() to decrement the reference count when done (Kernel Commit).

The vulnerability exists in the drivers/input/misc/sparcspkr.c file within the bbc_beep_probe function. The issue stems from not properly managing reference counts when using the of_find_node_by_path() function, which internally calls of_find_node_opts_by_path(). The function returns a node pointer with an incremented reference count, but the code failed to call of_node_put() to decrement the reference count when finished, leading to a reference count leak (NVD).

A reference count leak in the kernel can lead to memory resource exhaustion over time, potentially affecting system stability and performance. The vulnerability specifically affects the SPARC speaker driver subsystem (Ubuntu).

The vulnerability has been fixed by adding the missing of_node_put(dp) call in the bbc_beep_probe function. The fix was implemented in multiple kernel versions through backporting. Users should update their Linux kernel to a patched version that includes the fix (Kernel Commit).