CVE-2022-49712: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-49712 is a vulnerability discovered in the Linux kernel affecting the USB gadget driver for LPC32xx. The vulnerability was disclosed on February 26, 2025, and involves a refcount leak in the lpc32xxudcprobe function. The issue affects multiple versions of the Linux kernel, including versions from 4.10 through 5.19 (NVD).

The vulnerability stems from a reference counting issue where ofparsephandle() returns a node pointer with an incremented refcount, but the code failed to properly release it using ofnodeput() when no longer needed. This oversight resulted in a memory leak in the lpc32xxudcprobe function. The CVSS v3.1 base score for this vulnerability is 5.5 (Medium), with a vector string of CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD).

The vulnerability primarily affects system availability by causing a memory leak in the kernel's USB gadget driver. While the impact is limited to local systems and requires local user privileges, it could potentially lead to resource exhaustion over time (NVD).

The vulnerability has been patched in the Linux kernel by adding the missing ofnodeput() call to properly release the reference count. The fix was implemented through a series of patches across different kernel versions, as evidenced by multiple commit references (Kernel Patch).