CVE-2022-49016

What it actually does

Unbalanced fwnode reference count in MDIO bus PHY device registration causes a memory leak on device free when the fwnode is not an ACPI node; fwnode_handle_put is missing in the normal release path while get/put are unbalanced in the ACPI error path.

Why it matters to the business

Repeated device attach/detach operations (driver load tests, dynamic overlays, hotplug) on affected Linux systems gradually exhaust memory, risking instability or denial of service in network-heavy environments; high ecosystem prevalence increases exposure for servers, embedded devices, and appliances.

How an attack unfolds

An attacker triggers repeated MDIO PHY device registration and release cycles (via CONFIG_OF_DYNAMIC overlays or driver reloads) to accumulate leaked node references until memory pressure causes system degradation; no public in-the-wild exploitation or ransomware use is recorded.

How to fix it

Upgrade the Linux kernel to a release containing commit 543d917f691ab06885ee779c862065899eaa4251 (or the equivalent stable backport) and ensure fwnode_handle_put is called in phy_device_release while balancing fwnode_handle_get before phy_device_register for ACPI nodes.

How to confirm the fix worked

Confirm the presence of the balancing fwnode calls in phy_device_release and phy_device_register; run device load/unload tests with CONFIG_OF_UNITTEST and CONFIG_OF_DYNAMIC enabled and verify that OF refcount leak messages no longer appear.

Typical attack path

1. Identify Linux kernel lacking the reference-count fix
2. Obtain or trigger repeated MDIO device attach/detach operations
3. Monitor for increasing OF node refcounts until memory exhaustion occurs
4. Leverage resulting instability for denial of service or to facilitate follow-on attacks

How to detect it

Search kernel logs for the exact OF refcount error message emitted during device teardown; correlate with processes that perform MDIO or PHY device registration under dynamic device-tree configurations.

• OF: ERROR: memory leak, expected refcount 1 instead of 2
• of_node_get()/of_node_put() unbalanced - destroy cset entry
• attach overlay node /spi/soc@0/mdio@7107009c/ethernet-phy@0

What your security team should do

• Prioritize kernel updates on all exposed systems within standard patch windows
• Enable CONFIG_OF_DYNAMIC and monitor dmesg for unbalanced refcount warnings during driver testing
• Track memory usage trends on systems performing frequent MDIO or network device operations
• Include the OF memory-leak signature in log-monitoring rules