Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2022-49185
CVE-2022-49185:
Linux Kernel vulnerability analysis and mitigation
Overview
CVE-2022-49185 is a vulnerability in the Linux kernel's pinctrl nomadik driver, discovered and disclosed in February 2025. The issue specifically affects the nmkpinctrlprobe function in the Linux kernel's pinctrl subsystem. The vulnerability stems from a missing ofnodeput() call in the driver, which leads to a reference count leak (NVD).
Technical details
The vulnerability occurs in the nmkpinctrlprobe function where a node pointer returned by ofparsephandle() has its reference count incremented but not properly decremented. The issue specifically relates to the handling of the prcm node in the Device Tree. The bug was introduced in commit 32e67eee670e which added functionality to extract prcm_base from the Device Tree (Kernel Commit).
Impact
The vulnerability results in a reference count leak in the kernel's memory management system. While this type of issue typically leads to memory leaks, the direct impact is relatively minor as it only occurs during the driver probe phase (NVD).
Mitigation and workarounds
The issue has been fixed by adding the missing ofnodeput(prcmnp) call after the ofiomap operation. The fix has been implemented in various kernel versions through backporting of the original patch. Debian has marked this as fixed in versions 5.10.223-1, 6.1.129-1, and 6.12.17-1 (Debian Security).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management