CVE-2022-49447: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-49447 is a vulnerability discovered in the Linux kernel, specifically affecting the ARM HiSilicon (hisi) platform. The vulnerability was disclosed on February 26, 2025, and involves a reference counting issue in the device tree handling. The issue occurs when of_find_compatible_node() is called, which increments the reference count of the returned device_node without a corresponding decrement operation (NVD, Debian).

The vulnerability exists in the Linux kernel's ARM HiSilicon platform code, specifically in the platsmp.c file. The issue stems from missing of_node_put() calls after of_find_compatible_node(), which leads to a reference count leak in the device tree handling. The function of_find_compatible_node() increments the refcount of the returned device_node, but the code failed to call of_node_put() to decrement the reference count when it was no longer needed (Kernel Commit).

The vulnerability results in a reference count leak in the kernel's device tree handling. While this may not lead to immediate system compromise, it could potentially cause resource exhaustion over time as device node references are not properly released (NVD).

There is no public information available about active exploitation of this vulnerability in the wild. The vulnerability requires local access to the system and affects specific ARM-based systems using the HiSilicon platform (NVD).

The vulnerability has been fixed in multiple Linux kernel versions through patches that add the missing of_node_put() calls. The fix has been backported to various stable kernel branches. Ubuntu has marked this as a medium priority issue and has released fixes for several versions including 18.04 LTS (4.15.0-192.203) and other supported releases (Ubuntu).