CVE-2022-48907

What it actually does

Memory leak in the auxdisplay lcd2s driver where struct lcd2s_data allocated during probe is never released on device removal, leaving kernel memory permanently allocated until reboot.

Why it matters to the business

Long-running systems using the affected LCD driver may experience gradual memory exhaustion, leading to reduced performance, stability issues, or eventual kernel OOM conditions in embedded or server environments with repeated module load/unload cycles.

How an attack unfolds

An attacker with local access or the ability to trigger device removal (via module unload, hotplug, or error paths) can cause repeated allocations without corresponding frees, accumulating unreclaimed kernel memory over time until system resources are depleted.

How to fix it

Update to a kernel containing commit 5d53cd33f4253aa4cf02bf7e670b3c6a99674351 or later; for Qualcomm Android SoCs apply the 2021-09-05 SoCVersion fix that switches allocation to devm_kzalloc().

How to confirm the fix worked

Inspect the lcd2s driver source for devm_kzalloc() usage in probe and absence of explicit kfree in remove; verify running kernel contains the referenced commit or equivalent backport; monitor slabinfo or kmemleak reports for lcd2s_data objects after module unload.

Typical attack path

1. Identify system using lcd2s auxdisplay driver
2. Trigger repeated probe/remove cycles via module operations or device events
3. Accumulate unreleased struct lcd2s_data allocations
4. Monitor for kernel memory pressure or OOM events

How to detect it

Review kernel logs for lcd2s driver load/unload events; inspect kmemleak or /proc/slabinfo output for persistent lcd2s_data allocations after driver removal; correlate with dmesg entries showing probe/remove activity.

What your security team should do

• Apply the referenced kernel commit or vendor patch if the lcd2s driver is enabled
• Audit kernel configurations to disable unused auxdisplay drivers
• Monitor memory usage trends on systems with dynamic device attach/detach
• Incorporate the fixed commit into internal kernel builds and test for memory leaks