CVE-2022-48856

What it actually does

Missing of_node_put() after of_find_compatible_node() in gfar_get_ts_info causes a device-tree node reference count leak in the gianfar Ethernet driver.

Why it matters to the business

May lead to gradual resource exhaustion or system instability on Linux kernels using the gianfar driver in networking or embedded deployments; low EPSS and absence from KEV indicate limited immediate operational risk.

How an attack unfolds

A local attacker repeatedly invokes ethtool operations that call gfar_get_ts_info on a gianfar interface; each call leaks a reference without release, and over time this can exhaust memory or trigger denial of service.

How to fix it

Apply the kernel commit 6263f2eb93a85ad7df504daf0c341a7fb6bbe8a6 (or equivalent backports) that adds the missing of_node_put() call; rebuild and reboot into the fixed kernel version.

How to confirm the fix worked

Inspect the gfar_get_ts_info function in the gianfar ethtool source to confirm of_node_put() is present immediately after the of_find_compatible_node() call; test that repeated ethtool timestamp queries no longer leak references.

Typical attack path

1. Obtain local shell access on an affected Linux system
2. Identify a gianfar network interface
3. Execute ethtool timestamp queries repeatedly
4. Monitor for memory pressure or system instability

How to detect it

Examine kernel logs and dmesg for gianfar-related warnings; track reference-count or memory-leak reports from tools such as kmemleak after heavy ethtool usage; no specific post-exploitation artifacts are expected.

What your security team should do

• Prioritize kernel updates on systems exposing gianfar interfaces
• Limit local user access on affected devices until patched
• Include the fix in standard kernel update and reboot cycles
• Review any downstream device trees or drivers that call similar of_find_compatible_node patterns