CVE-2022-48660

What it actually does

Race condition in gpiolib cdev error path where lineevent_state::irq is set before request_threaded_irq succeeds, causing free_irq to be called on an invalid descriptor and triggering a kernel warning trace during lineevent_free.

Why it matters to the business

Local users on affected Linux systems can trigger kernel warnings or crashes when using GPIO monitoring tools, leading to reduced system stability and potential denial of service on platforms such as NXP LS1028; widespread kernel dependency increases exposure across servers, embedded devices, and distributions.

How an attack unfolds

An attacker with local access runs a gpio monitoring command such as gpiomon that exercises the ioctl path; when request_threaded_irq fails, lineevent_free is invoked while irq is already set, resulting in the invalid free_irq call and warning trace.

How to fix it

Upgrade the Linux kernel to a version containing commit 657803b918e097e47d99d1489da83a603c36bcdd or later; rebuild and reboot with the patched kernel; apply vendor or distribution backports if available for the running release.

How to confirm the fix worked

Confirm the running kernel source contains commit 657803b918e097e47d99d1489da83a603c36bcdd; re-execute the gpiomon command that previously triggered the trace and verify absence of the free_irq warning in dmesg or kernel logs.

Typical attack path

1. Obtain local user access on a vulnerable Linux kernel
2. Invoke GPIO character device ioctl via gpiomon or equivalent tool targeting a gpiochip line
3. Trigger failure in request_threaded_irq registration
4. Cause lineevent_free to execute free_irq on the prematurely set irq value
5. Observe kernel warning trace and potential process or system impact

How to detect it

Search kernel logs and dmesg for the call trace containing free_irq+0x204, lineevent_free+0x64, and gpio_ioctl; correlate with execution of gpiomon or gpio character device ioctls around the same timestamp.

• free_irq+0x204/0x360
• lineevent_free+0x64/0x70
• gpio_ioctl+0x598/0x6a0
• Call trace:.*lineevent_free

What your security team should do

• Prioritize kernel updates on systems exposing GPIO character devices to untrusted local users
• Monitor kernel logs for the free_irq and lineevent_free call trace pattern
• Restrict local access to gpiochip devices via udev rules or group permissions until patched
• Test patched kernels in staging environments before broad deployment