CVE-2022-49447: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-49447 is a vulnerability discovered in the Linux kernel, specifically affecting the ARM HiSilicon (hisi) platform. The vulnerability was disclosed on February 26, 2025, and involves a reference counting issue in the device tree handling. The issue occurs when offindcompatiblenode() is called, which increments the reference count of the returned devicenode without a corresponding decrement operation (NVD, Debian).

The vulnerability exists in the Linux kernel's ARM HiSilicon platform code, specifically in the platsmp.c file. The issue stems from missing ofnodeput() calls after offindcompatiblenode(), which leads to a reference count leak in the device tree handling. The function offindcompatiblenode() increments the refcount of the returned devicenode, but the code failed to call ofnode_put() to decrement the reference count when it was no longer needed (Kernel Commit).

The vulnerability results in a reference count leak in the kernel's device tree handling. While this may not lead to immediate system compromise, it could potentially cause resource exhaustion over time as device node references are not properly released (NVD).

The vulnerability has been fixed in multiple Linux kernel versions through patches that add the missing ofnodeput() calls. The fix has been backported to various stable kernel branches. Ubuntu has marked this as a medium priority issue and has released fixes for several versions including 18.04 LTS (4.15.0-192.203) and other supported releases (Ubuntu).