CVE-2022-48693

What it actually does

The vulnerability is a pair of resource leaks in brcmstb_pm_probe(): missing of_node_put() on early exit from for_each_matching_node() and missing iounmap() on failure paths, allowing reference counts and __iomem mappings to accumulate.

Why it matters to the business

On Broadcom STB platforms running affected kernels, repeated device probing can gradually exhaust memory and mapping resources, raising the chance of system instability or the need for unplanned reboots.

How an attack unfolds

An attacker with the ability to trigger repeated probe attempts (for example by loading or unloading the driver or causing device re-enumeration) can exercise the error paths that omit cleanup, slowly consuming kernel resources until availability is impacted.

How to fix it

Upgrade the Linux kernel to a version that includes commit 0284b4e6dec6088a41607aa3f42bf51edff01883 (or the equivalent stable backport) in the soc/brcmstb/pm-arm.c file.

How to confirm the fix worked

Confirm the fix is present by inspecting the source for of_node_put() and iounmap() calls on all exit paths of brcmstb_pm_probe(), or verify the running kernel contains the referenced commit.

Typical attack path

1. Obtain local access or the ability to influence driver loading on an affected Broadcom STB system
2. Cause the brcmstb_pm_probe() function to execute and hit an early-exit or error path
3. Repeat the triggering action to accumulate leaked references and mappings
4. Observe progressive resource exhaustion leading to denial of service

How to detect it

Examine kernel boot logs and dmesg for repeated brcmstb_pm_probe entries that terminate without normal completion; correlate with rising slab or iomem usage on affected hardware via standard memory accounting tools.

What your security team should do

• Prioritize kernel updates on all Broadcom STB systems to the fixed commit
• Review boot and module-load logs for signs of repeated probe failures
• Apply the update within normal change windows given the local attack vector and moderate CVSS