CVE-2022-49621: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-49621 is a vulnerability discovered in the Linux kernel's cpufreq component, specifically in the pmac32-cpufreq driver. The issue was identified as a refcount leak bug in the pmaccpufreqinit_MacRISC3() function. The vulnerability was disclosed and patched in 2022, affecting various Linux kernel versions (Kernel Git).

The vulnerability stems from a reference counting issue in the pmac32-cpufreq driver where three node pointers (voltgpionp, freqgpionp, and slewdonegpionp) had their refcount incremented by offindnodebyname() but lacked corresponding ofnode_put() calls. This resulted in a memory leak in the kernel. The CVSS v3 Base Score for this vulnerability is 5.5 (Medium) (Red Hat CVE).

The refcount leak bug could lead to memory resource exhaustion over time, potentially affecting system stability and performance on affected Linux systems using the pmac32-cpufreq driver (Ubuntu Security).

The vulnerability has been fixed through a patch that adds the missing ofnodeput() calls for the three affected node pointers. The fix has been backported to various maintained kernel versions. Users are advised to update their Linux kernel to a patched version (Kernel Git).