CVE-2022-48778

What it actually does

Failure to decrement the PM runtime usage counter on error return from gpmi_nfc_apply_timings leaves a reference held, causing a leak in the power-management accounting for the NAND controller.

Why it matters to the business

Repeated triggering of the error path on affected Linux systems can gradually exhaust runtime PM references, leading to degraded power management behavior and potential denial-of-service conditions in NAND-flash-dependent devices or servers; urgency remains low given the 823-day publication age and negligible EPSS.

How an attack unfolds

An attacker with local access or the ability to induce timing-application failures in the GPMI NAND driver repeatedly triggers the error path so that each failure leaks a PM reference until the usage counter is exhausted or kernel behavior is disrupted.

How to fix it

Upgrade to a fixed kernel package version: Debian 11 to 5.10.92-1 or later, Debian 12/13 to 5.15.15-1 or later; Ubuntu 20.04 LTS variants to the listed 5.15.0-*-20.04.1 or 5.4.0-* packages; Ubuntu 22.04 LTS to 5.15.0-17.17 or later. Reboot after installation.

How to confirm the fix worked

Verify the running kernel version matches or exceeds the fixed package listed for the distribution; confirm absence of the original reference-leak code path via source inspection or by exercising the error path under PM runtime tracing.

Typical attack path

1. Obtain local execution or craft workload that forces gpmi_nfc_apply_timings to fail
2. Cause repeated error returns without the corresponding put
3. Accumulate leaked PM references until power-management or NAND I/O is impaired

How to detect it

Review kernel logs for repeated GPMI NAND timing failures accompanied by power-management reference warnings; correlate with process activity that exercises NAND flash under error conditions.

What your security team should do

• Prioritize patching of internet-facing or multi-tenant systems first
• Apply the distribution-specific fixed packages and schedule reboots
• Monitor EPSS and any future threat-actor mentions; re-evaluate if new exploitation appears