CVE-2023-22996

What it actually does

Missing put_device after of_find_device_by_node in drivers/soc/qcom/qcom_aoss.c causes a reference count leak that can exhaust kernel resources.

Why it matters to the business

Affected Linux systems on Qualcomm platforms risk instability, degraded performance, or crashes from gradual resource exhaustion in kernel memory management.

How an attack unfolds

A local attacker with low privileges triggers the AOSS device lookup code path repeatedly, leaking references each time until the kernel runs out of resources and denies service.

How to fix it

Update the Linux kernel to a version containing commit 4b41a9d0fe3db5f91078a380f62f0572c3ecf2dd (equivalent to 5.17.2 or later) in torvalds/linux.

How to confirm the fix worked

Inspect the qcom_aoss.c source for a matching put_device call after of_find_device_by_node, or confirm the running kernel is at least version 5.17.2.

Typical attack path

1. Gain local user access on an affected system
2. Execute code that invokes the vulnerable AOSS node lookup routine
3. Repeat the trigger to accumulate unreleased references
4. Induce kernel memory pressure leading to denial of service

How to detect it

Review kernel logs for repeated device reference warnings or OOM events tied to qcom_aoss; no widespread exploitation indicators have been observed.

What your security team should do

• Apply the kernel fix containing commit 4b41a9d0fe3db5f91078a380f62f0572c3ecf2dd on all affected systems
• Prioritize updates for Qualcomm-based embedded or server deployments
• Monitor kernel memory usage and OOM events on systems running older kernels