CVE-2022-48708

What it actually does

NULL pointer dereference in pcs_set_mux() when pinmux_generic_get_function() returns NULL, allowing the function pointer to be used without validation and triggering a kernel crash or memory corruption.

Why it matters to the business

Unpatched Linux kernel systems face risk of unexpected crashes or instability during pin control operations, potentially causing service outages on affected devices or servers.

How an attack unfolds

An attacker with the ability to influence pinmux configuration triggers pcs_set_mux() under conditions where pinmux_generic_get_function() returns NULL; the missing NULL check then leads to dereference and kernel fault.

How to fix it

Apply the upstream fix by updating to the kernel commit 1177bdafe87cbe543a2dc48a9bbac265aa5864db or a later stable release containing the NULL check in pcs_set_mux().

How to confirm the fix worked

Inspect the pinctrl-single source for the added NULL guard on the function pointer after calling pinmux_generic_get_function(); confirm the running kernel includes the referenced commit.

Typical attack path

1. Identify a system running a vulnerable Linux kernel version with pinctrl-single enabled.
2. Craft or trigger pinmux configuration that causes pinmux_generic_get_function() to return NULL.
3. Invoke pcs_set_mux() to perform the unchecked dereference.
4. Observe resulting kernel oops or panic for denial-of-service effect.

How to detect it

Review kernel logs and crash dumps for oops or panic messages referencing pcs_set_mux or pinctrl-single NULL dereference; correlate with pinmux configuration changes.

What your security team should do

• Prioritize kernel updates containing commit 1177bdafe87cbe543a2dc48a9bbac265aa5864db on all affected systems.
• Monitor kernel logs for NULL dereference oops involving pinctrl-single.
• Test patched kernels in staging environments before broad deployment.