What’s Vulnerable › Vulnerabilities

CVE-2022-49447: ARM: hisi: Add missing of_node_put after of_find_compatible_node

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-02-26 · updated 2026-06-17

Description

In the Linux kernel, the following vulnerability has been resolved: ARM: hisi: Add missing of_node_put after of_find_compatible_node of_find_compatible_node will increment the refcount of the returned device_node. Calling of_node_put() to avoid the refcount leak

Affected products

• Linux kernel: before 4.9.318; from 4.10 before 4.14.283; from 4.15 before 4.19.247; from 4.20 before 5.4.198; from 5.5 before 5.10.121; from 5.11 before 5.15.46 — fixed in 4.14.283, 4.19.247, 4.9.318, 5.10.121, 5.15.46, 5.17.14

How to fix

Upgrade to a fixed version: Linux kernel 4.14.283, 4.19.247, 4.9.318, 5.10.121. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/21a3effe446dd6dc5eed7fe897c2f9b88c9a5d6d
• https://git.kernel.org/stable/c/45d211668d33c49d73f5213e8c2b58468108647c
• https://git.kernel.org/stable/c/46cb7868811d025c3d29c10d18b3422db1cf20d5
• https://git.kernel.org/stable/c/9bc72e47d4630d58a840a66a869c56b29554cfe4
• https://git.kernel.org/stable/c/a3265a9440030068547a20dfee646666f3ca5278
• https://git.kernel.org/stable/c/cafaaae4bb9ce84a2791fa29bf6907a9466c3883
• https://git.kernel.org/stable/c/dd4be8ecfb41a29e7c4e551b4e866157ce4a3429
• https://git.kernel.org/stable/c/e109058165137ef42841abd989f080adfefa14fa
• https://git.kernel.org/stable/c/f8da78b2bae1f54746647a2bb44f8bd6025c57af

Get alerted when CVE-2022-49447 or the next vulnerability affects your stack