CVE-2024-46767: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-46767 affects the Linux kernel's PHY (Physical Layer) LED handling functionality. The vulnerability was discovered in September 2024 and involves a missing reference count decrement operation in the network device driver subsystem. The issue specifically affects the PHY LED binding implementation in the Linux kernel (Ubuntu Security).

The vulnerability stems from a missing ofnodeput() call for LED nodes in the PHY device driver. When ofgetchildbyname() is called, it increments the reference count for LEDs, but the code path failed to properly decrease this count with ofnodeput() upon success, leading to a potential reference count leak (Kernel Commit).

While the direct impact is a reference count leak in the kernel's memory management system, this type of issue could potentially lead to memory resource exhaustion over time in systems that frequently initialize or reconfigure PHY LED configurations (Ubuntu Security).

The issue has been fixed in Linux kernel version 6.8.0 and backported to various stable kernel releases. Ubuntu has released patches for affected versions including 24.04 LTS (noble) and 22.04 LTS (jammy). Users should update their systems to the patched kernel versions (Ubuntu Security).