CVE-2022-49887: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-49887 is a vulnerability discovered in the Linux kernel's media: meson: vdec component, specifically related to a potential refcount leak in the vdec_probe() function. The vulnerability was published on May 1, 2025, and affects multiple versions of the Linux kernel from version 5.4 through 6.1-rc1 (NVD).

The vulnerability stems from improper reference counting in the video decoder (vdec) probe function. When v4l2deviceregister is called during probe initialization, the obtained reference count needs to be properly released by calling v4l2deviceunregister in error paths or during device removal. The vulnerability has been assigned a CVSS v3.1 Base Score of 5.5 (MEDIUM) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD).

The vulnerability can result in a refcount leak if the vdec_probe function fails or during device removal operations. This may lead to resource leaks in the kernel's memory management, potentially affecting system stability (Wiz).

The vulnerability has been resolved by ensuring proper reference count management through calling v4l2deviceunregister in the appropriate error handling paths and during device removal. Fixed versions are available for various Linux distributions, including Debian Bullseye (5.10.234-1), Bookworm (6.1.135-1), and Trixie (6.12.25-1) (Debian).