CVE-2022-48852

What it actually does

Failure to unregister the HDMI codec device on unbind in the drm/vc4 driver causes a persistent device reference leak.

Why it matters to the business

Over time systems may experience gradual resource exhaustion or driver instability on repeated graphics device attach/detach cycles, increasing maintenance overhead especially in long-lived deployments.

How an attack unfolds

An attacker with local privileges repeatedly triggers HDMI codec bind and unbind operations to accumulate leaked device objects; no public exploitation or ransomware use is recorded and EPSS remains low with no change over 30 days.

How to fix it

Upgrade affected components to the fixed commit ecef31d2b266fde17eb2c3415e2ec4ceff96fbeb; apply kernel updates containing the drm/vc4 hdmi unbind fix as soon as they are available from your distribution.

How to confirm the fix worked

Confirm the presence of the unregister call on unbind in the vc4 hdmi driver source and verify that no device reference counts grow across repeated bind/unbind test cycles.

Typical attack path

1. Obtain local user access on an affected Linux system
2. Trigger repeated HDMI codec device bind/unbind sequences via graphics or display APIs
3. Accumulate leaked device references leading to resource pressure

How to detect it

Review kernel logs for repeated vc4 hdmi codec registration messages without corresponding unregistration entries; examine device reference counts via debugfs or similar interfaces for unexpected growth.

What your security team should do

• Prioritize patching systems that expose graphics hardware to untrusted local users
• Monitor vendor kernel update channels for the vc4 hdmi unbind fix
• Test graphics suspend/resume and hotplug paths after applying updates