CVE-2022-49683: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-49683 is a vulnerability in the Linux kernel's ADI AXI ADC driver that involves a reference count leak in the adi_axi_adc_attach_client function. The issue was discovered and reported in May 2022, affecting the Industrial I/O (IIO) subsystem's ADC driver for Analog Devices AXI ADC IP core (Kernel Commit).

The vulnerability stems from a missing of_node_put() call in the adi_axi_adc_attach_client function. The of_parse_phandle() function returns a node pointer with an incremented reference count, which should be properly decremented using of_node_put() when no longer needed. The missing call leads to a reference count leak in the kernel's memory management system (Kernel Commit).

The reference count leak could potentially lead to memory resource exhaustion in the Linux kernel over time, particularly in systems using the ADI AXI ADC driver.

The issue has been fixed by adding the missing of_node_put() calls in the adi_axi_adc_attach_client function. The fix was implemented through a patch that adds three of_node_put(cln) calls at appropriate exit points in the function (Kernel Commit).