CVE-2022-49480: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-49480 affects the Linux kernel's ASoC (ALSA System on Chip) imx-hdmi driver. The vulnerability was discovered in the imx_hdmi_probe function where a reference count leak occurs when of_find_device_by_node() is called but the device reference is not properly released with put_device() in the error path when devm_kzalloc() fails (Kernel Git).

The technical issue involves a reference counting bug in the Linux kernel's sound/soc/fsl/imx-hdmi.c file. When the of_find_device_by_node() function is called, it takes a reference to the device, but if the subsequent devm_kzalloc() call fails, the code path lacks the corresponding put_device() call to release that reference, resulting in a reference count leak (Kernel Git).

The vulnerability can lead to a memory leak in the kernel when the imx-hdmi driver initialization fails. This could potentially cause system resource exhaustion over time if the failure condition is triggered repeatedly (Ubuntu Security).

The vulnerability requires local access to the system and the presence of the imx-hdmi hardware. It can only be triggered during the driver initialization phase when memory allocation fails (Ubuntu Security).

The issue has been fixed by adding the missing put_device() call in the error path of imx_hdmi_probe function. The fix has been incorporated into various Linux kernel versions and distributions. Ubuntu has marked this as a medium priority issue and is working on updates for affected versions (Ubuntu Security).