CVE-2022-48859

What it actually does

Missing of_node_put() after of_find_compatible_node() in prestera_switch_set_base_mac_addr leaves a device node reference count incremented, causing a kernel memory leak.

Why it matters to the business

Repeated triggering on affected Linux systems can exhaust kernel memory, leading to instability or denial of service for network operations over time.

How an attack unfolds

An attacker with local access triggers the prestera driver initialization path repeatedly; each invocation leaks a reference without exhausting the counter, gradually consuming kernel resources until the system becomes unresponsive.

How to fix it

Update the Linux kernel to include commit b7c2fd1d126329340639adfb8dd2938fe4b65df7 which adds the missing of_node_put() call.

How to confirm the fix worked

Verify the presence of the of_node_put() call after of_find_compatible_node() in prestera_switch_set_base_mac_addr within the running kernel source or confirm the kernel build contains commit b7c2fd1d126329340639adfb8dd2938fe4b65df7.

Typical attack path

1. Obtain local shell or user context on a system using the Marvell Prestera driver
2. Trigger repeated device probe or switch initialization events that call prestera_switch_set_base_mac_addr
3. Accumulate reference count leaks until kernel memory pressure causes failure

How to detect it

Examine kernel logs for repeated device initialization messages from the prestera driver and correlate with gradual increases in kernel slab or reference-counted object usage via slabinfo or similar tooling; no post-exploitation artifacts are typically left.

What your security team should do

• Apply the referenced upstream commit or a distribution kernel update containing the fix as soon as possible
• Prioritize systems exposing the Prestera driver in production or high-availability environments
• Monitor for unusual kernel memory growth on affected hosts until patched