CVE-2022-49244 is a vulnerability identified in the Linux kernel specifically within the ALSA System on Chip (ASoC) driver for MediaTek hardware, namely the mt8192-mt6359 device. The issue arises from improper error handling in the function mt8192_mt6359_dev_probe. This function uses the of_parse_phandle() call to obtain a device_node pointer, which increments the reference count of the node. Proper management of this reference count requires a corresponding call to of_node_put() to decrement it when the node is no longer needed. However, the vulnerable code only calls of_node_put() in the normal execution path and neglects to do so in error paths. This results in a reference count leak when errors occur during device probing. Over time, such leaks can lead to resource exhaustion within the kernel, potentially causing system instability or crashes. Although this vulnerability does not directly allow code execution or privilege escalation, the resource leak can degrade system reliability, especially on devices heavily utilizing the affected MediaTek components. The vulnerability affects specific Linux kernel versions identified by commit hashes, indicating it is present in certain kernel builds prior to the fix. No known exploits are reported in the wild, and no CVSS score has been assigned yet. The fix involves ensuring that of_node_put() is called in all code paths, including error handling, to properly manage the reference count and prevent leaks.

For European organizations, the impact of CVE-2022-49244 is primarily related to system stability and availability rather than direct compromise of confidentiality or integrity. Organizations using Linux-based systems with MediaTek mt8192-mt6359 hardware, such as embedded devices, IoT equipment, or specialized industrial systems, may experience kernel resource leaks leading to degraded performance or unexpected reboots. This can disrupt critical operations, especially in sectors relying on embedded Linux devices like telecommunications, manufacturing, or smart infrastructure. While the vulnerability does not enable remote code execution or privilege escalation, persistent resource leaks can increase maintenance overhead and risk of downtime. The absence of known exploits reduces immediate risk, but unpatched systems remain vulnerable to potential future exploitation or cumulative stability issues. European organizations deploying Linux kernels with these affected MediaTek drivers should assess their exposure, particularly in environments where device uptime and reliability are critical.

To mitigate CVE-2022-49244, organizations should: 1) Identify Linux systems running kernels with the affected MediaTek mt8192-mt6359 ASoC drivers by checking kernel versions and commit hashes. 2) Apply the official Linux kernel patches that fix the error handling to ensure of_node_put() is called on all code paths, including error paths. If official patches are not yet available, consider backporting the fix from the latest kernel source. 3) Monitor system logs for signs of kernel resource leaks or instability that could indicate the vulnerability is impacting operations. 4) For embedded or IoT devices where kernel updates are challenging, coordinate with device vendors to obtain firmware updates incorporating the fix. 5) Implement robust system monitoring and automated reboot policies to minimize downtime in case of resource exhaustion. 6) Maintain an inventory of devices using MediaTek hardware to prioritize patching and risk management. These steps go beyond generic advice by focusing on hardware-specific driver updates, proactive monitoring, and vendor coordination.