CVE-2022-49621: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-49621 is a vulnerability discovered in the Linux kernel's cpufreq component, specifically in the pmac32-cpufreq driver. The issue was identified as a refcount leak bug in the pmac_cpufreq_init_MacRISC3() function. The vulnerability was disclosed and patched in 2022, affecting various Linux kernel versions (Kernel Git).

The vulnerability stems from a reference counting issue in the pmac32-cpufreq driver where three node pointers (volt_gpio_np, freq_gpio_np, and slew_done_gpio_np) had their refcount incremented by of_find_node_by_name() but lacked corresponding of_node_put() calls. This resulted in a memory leak in the kernel. The CVSS v3 Base Score for this vulnerability is 5.5 (Medium) (Red Hat CVE).

The refcount leak bug could lead to memory resource exhaustion over time, potentially affecting system stability and performance on affected Linux systems using the pmac32-cpufreq driver (Ubuntu Security).

The vulnerability requires local access to exploit, as it affects kernel-level CPU frequency management functionality. There are no known public exploits targeting this vulnerability in the wild.

The vulnerability has been fixed through a patch that adds the missing of_node_put() calls for the three affected node pointers. The fix has been backported to various maintained kernel versions. Users are advised to update their Linux kernel to a patched version (Kernel Git).