CVE-2022-48961

What it actually does

Unbalanced fwnode reference count in mdio_device_release() due to missing fwnode_handle_put() after fwnode_handle_get() in of_mdiobus_register_device(), causing refcount leak and memory leak on device release.

Why it matters to the business

Gradual memory exhaustion on systems using MDIO with device-tree overlays, leading to potential instability or crashes during prolonged operation; low exploitation likelihood reduces immediate risk despite kernel presence.

How an attack unfolds

An attacker with local access or ability to trigger mdio device probing (such as via hardware attach or overlay) repeatedly registers and releases devices to accumulate the leak; no known active campaigns or ransomware use reported.

How to fix it

Apply kernel patches that add fwnode_handle_put() inside mdio_device_release() and ensure mdio_device_free() is used in error paths; update to a release containing the fix for the affected mdio code.

How to confirm the fix worked

After patching, reprobe mdio devices and confirm no OF refcount leak warnings appear in dmesg; verify balanced of_node_get/of_node_put counts via debug tooling.

Typical attack path

1. Attach or overlay a device-tree node for an MDIO ethernet device
2. Trigger of_mdiobus_register_device() which performs unbalanced fwnode_handle_get()
3. Release the mdio device via normal path or error handling
4. Observe accumulating refcount without corresponding put() or kfree balance

How to detect it

Review kernel logs for 'OF: ERROR: memory leak, expected refcount 1 instead of 2' messages tied to mdio or ethernet nodes; inspect device probe paths and overlay attach events for repeated unbalanced refcount patterns.

What your security team should do

• Prioritize patching kernel on systems exposing MDIO interfaces or using dynamic device-tree overlays
• Monitor EPSS trend (stable at ~0.0024) and re-evaluate if new threat actor activity emerges
• Audit device-tree usage in embedded or networking deployments for exposure