CVE-2022-48965

What it actually does

Reference count leak in rockchip_gpiolib_register() where of_get_parent() increments the node refcount without a matching of_node_put() call at the end of of_pinctrl_get().

Why it matters to the business

Over time, repeated use of affected GPIO paths on Rockchip-based systems can exhaust kernel resources, leading to degraded stability or denial-of-service conditions in embedded or server environments.

How an attack unfolds

An attacker with local code execution triggers repeated invocations of the pinctrl registration path, each time leaking a reference and gradually consuming kernel memory until the system becomes unstable or crashes.

How to fix it

Apply the upstream fix that adds the missing of_node_put() call; update to a kernel containing commit 7f1791488463d4e9c5adcd543962173e2f6cbd34 or later equivalent.

How to confirm the fix worked

Inspect the rockchip_gpiolib_register() and of_pinctrl_get() functions in the running kernel source or binary to confirm presence of the balancing of_node_put() after of_get_parent().

Typical attack path

1. Obtain local access on a Rockchip-based Linux system
2. Repeatedly exercise GPIO or pinctrl registration code paths
3. Observe progressive resource depletion or kernel warnings
4. Escalate to denial of service or system instability

How to detect it

Review kernel logs and traces for repeated rockchip_gpiolib_register activity without corresponding cleanup; correlate with memory pressure indicators on Rockchip platforms.

What your security team should do

• Prioritize kernel updates on all Rockchip-based devices
• Monitor kernel memory usage and GPIO-related logs for leaks
• Test the fix in staging environments before broad deployment