CVE-2022-49421: video: fbdev: clcdfb: Fix refcount leak in clcdfb_of_vram_setup
Vulnerability summary
CVE-2022-49421 is a medium (CVSS 5.5) vulnerability in linux. EPSS estimates a 0.29% chance of exploitation in the next 30 days, higher than 21.7% of scored vulnerabilities.
Not severe (CVSS 5.5, local access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 7 · Related 7Timeline
- 26-02-2025PublishedVulnerability first disclosed.
- 11-05-2026Last modifiedVulnerability information updated.
Description
In the Linux kernel, the following vulnerability has been resolved: video: fbdev: clcdfb: Fix refcount leak in clcdfb_of_vram_setup of_parse_phandle() returns a node pointer with refcount incremented, we should use of_node_put() on it when not need anymore. Add missing of_node_put() to avoid refcount leak.
CVSS metrics
3 scores · 3 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.29%
Chance of exploitation in the next 30 days
Percentile
22%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.29% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Ubuntu111 products
- linuxAll versions (No fix recorded) | < 4.15.0-192.203 | < 5.4.0-126.142 | < 5.15.0-47.51
- linux-allwinner-5.19All versions (No fix recorded)
- linux-awsAll versions (No fix recorded) | < 4.15.0-1140.151 | < 5.4.0-1085.92 | < 5.15.0-1019.23
- linux-aws-5.0All versions (No fix recorded)
- linux-aws-5.11All versions (No fix recorded)
Linux2 products
- linux≥ d10715be03bd8bad59ddc50236cb140c3bd73c7b, < 6c92711db7c90f78e0b67ac2a8944d0fe7e12d83 | ≥ d10715be03bd8bad59ddc50236cb140c3bd73c7b, < 2e2e2c71b2642289438392edbf5d08cdbc0b138b | ≥ d10715be03bd8bad59ddc50236cb140c3bd73c7b, < 51eb1bb6baeb478538dd4ec6459fd68c44a855b1 | ≥ d10715be03bd8bad59ddc50236cb140c3bd73c7b, < 8db59df7f5826e104db82cfddbf22a33a151193e | ≥ d10715be03bd8bad59ddc50236cb140c3bd73c7b, < c1c4405222b6fc98c16e8c2aa679c14e41d81465 | ≥ d10715be03bd8bad59ddc50236cb140c3bd73c7b, < f2dfb4ab887d67be7d0892ba041d3c8d738d3356 | ≥ d10715be03bd8bad59ddc50236cb140c3bd73c7b, < bbb2a24e863b6a10129546a0a4ceea2f07deec39 | ≥ d10715be03bd8bad59ddc50236cb140c3bd73c7b, < 38d245cebf545338a6bc1c7762023de3fbecd7b7 | ≥ d10715be03bd8bad59ddc50236cb140c3bd73c7b, < b23789a59fa6f00e98a319291819f91fbba0deb8 | 3.17
- linux_kernel≥ 3.17, < 4.9.318 | ≥ 4.10, < 4.14.283 | ≥ 4.15, < 4.19.247 | ≥ 4.20, < 5.4.198 | ≥ 5.5, < 5.10.121 | ≥ 5.11, < 5.15.46 | ≥ 5.16, < 5.17.14 | ≥ 5.18, < 5.18.3
Debian1 product
- linux< 5.18.5-1
3 vendors · 114 products
