CVE-2022-48656

What it actually does

Missing of_node_put() call on device tree node reference returned by of_parse_phandle() in error or unused paths inside of_xudma_dev_get() causes a reference count leak.

Why it matters to the business

Over time the leak can exhaust kernel memory on affected Linux systems, leading to degraded performance or denial of service for workloads that exercise the TI K3 UDMA driver.

How an attack unfolds

An attacker with local access triggers repeated calls to of_xudma_dev_get() that hit the failure or early-return paths without decrementing the node reference, gradually consuming kernel memory until the system becomes unstable.

How to fix it

Upgrade the Linux kernel to a version containing commit aa11dae059a439af82bae541b134f8f53ac177b5 or later; apply the stable backports that move the of_node_put() call before the failure check.

How to confirm the fix worked

Verify the running kernel Git commit or version string contains aa11dae059a439af82bae541b134f8f53ac177b5; inspect the of_xudma_dev_get() function to confirm of_node_put() precedes the error-path return.

Typical attack path

1. Obtain local user or container access on a Linux system using the TI K3 UDMA private driver
2. Trigger code paths that invoke of_xudma_dev_get() and exercise its error or early-exit branches
3. Repeat the triggering action to accelerate the reference count leak
4. Monitor for memory pressure or kernel OOM conditions that disrupt services

How to detect it

Review kernel logs for repeated of_parse_phandle() calls without matching of_node_put() activity and watch for gradual increases in slab or device-tree related memory usage on systems exposing the K3 UDMA driver.

What your security team should do

• Prioritize kernel updates on all systems that include the ti:k3-udma-private driver
• Monitor kernel memory usage and OOM events on affected hosts until patched
• Restrict local access and container privileges on unpatched systems to reduce leak-triggering opportunities