CVE-2022-49683: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-49683 is a vulnerability in the Linux kernel's ADI AXI ADC driver that involves a reference count leak in the adiaxiadcattachclient function. The issue was discovered and reported in May 2022, affecting the Industrial I/O (IIO) subsystem's ADC driver for Analog Devices AXI ADC IP core (Kernel Commit).

The vulnerability stems from a missing ofnodeput() call in the adiaxiadcattachclient function. The ofparsephandle() function returns a node pointer with an incremented reference count, which should be properly decremented using ofnodeput() when no longer needed. The missing call leads to a reference count leak in the kernel's memory management system (Kernel Commit).

The reference count leak could potentially lead to memory resource exhaustion in the Linux kernel over time, particularly in systems using the ADI AXI ADC driver.

The issue has been fixed by adding the missing ofnodeput() calls in the adiaxiadcattachclient function. The fix was implemented through a patch that adds three ofnodeput(cln) calls at appropriate exit points in the function (Kernel Commit).