CVE-2022-48860

What it actually does

Missing of_node_put() after of_parse_phandle() in xemaclite_of_probe leaves a device node reference count incremented, causing a refcount leak.

Why it matters to the business

Over time the leak can exhaust kernel memory or device node resources on systems that repeatedly load or probe the driver, leading to instability or denial of service.

How an attack unfolds

An attacker with local access triggers repeated module load or device probe paths that call the buggy probe function; each invocation leaks a reference without ever releasing it, eventually exhausting resources.

How to fix it

Update the Linux kernel to a version containing commit 669172ce976608b25a2f76f3c65d47f042d125c9 or later; rebuild and deploy the fixed kernel image.

How to confirm the fix worked

Confirm the running kernel contains commit 669172ce976608b25a2f76f3c65d47f042d125c9; inspect the xemaclite_of_probe function for the presence of of_node_put() after of_parse_phandle().

Typical attack path

1. Obtain local access to the system
2. Trigger repeated probe or module reload of the xemaclite driver
3. Accumulate leaked device node references until resource exhaustion occurs

How to detect it

Review kernel logs for repeated probe failures or warnings related to xemaclite; monitor for increasing device node reference counts via /proc or debugfs over time.

What your security team should do

• Prioritize kernel upgrade on all systems using the xemaclite Ethernet driver
• Monitor for repeated probe events or memory pressure after applying the fix
• Add the driver to the list of components rebuilt during kernel update cycles