CVE-2022-48888

What it actually does

Memory leak in drm/msm/dpu due to of_icc_get allocating resources for path1 that are not released on early return when path0 is IS_ERR_OR_NULL.

Why it matters to the business

Repeated triggering can lead to gradual memory exhaustion on Linux systems using MSM DPU hardware, causing performance degradation, instability, or system crashes over extended operation.

How an attack unfolds

An attacker with local access triggers msm_mdss_parse_data_bus_icc_path repeatedly under conditions where path0 fails, leaking path1 resources each time until memory pressure impacts the system.

How to fix it

Update to Linux kernel commit c6fa1de83fd87267ab24359e6fa52f98f5cee3f9 or later stable versions that defer path1 acquisition to prevent the leak.

How to confirm the fix worked

Confirm the presence of the fix commit in the running kernel source or binary; monitor kernel memory usage statistics during repeated driver initialization for absence of incremental leaks.

Typical attack path

1. Obtain local access to a vulnerable Linux kernel with MSM DPU driver loaded
2. Trigger device initialization or display configuration code paths that invoke msm_mdss_parse_data_bus_icc_path
3. Force repeated early returns on path0 error to accumulate unreleased path1 allocations
4. Continue until memory exhaustion produces denial of service or system instability

How to detect it

Review kernel logs for repeated msm_mdss_parse_data_bus_icc_path calls combined with rising memory usage; inspect slab or kmemleak reports for unreleased ICC path allocations after device probe failures.

What your security team should do

• Prioritize patching all affected Linux kernel instances to the fixed commit
• Audit systems for MSM DPU hardware usage and apply updates before prolonged uptime periods
• Monitor kernel memory metrics for unusual growth patterns pending patch deployment