CVE-2022-48975

What it actually does

Memory leak in gpiochip_setup_dev() where device_add() succeeds but subsequent resources like struct device_private are not released because device_del() does not free them, combined with erroneous kcalloc/kfree on ZERO_PTR when ngpio equals zero.

Why it matters to the business

Gradual memory exhaustion on Linux systems exposing GPIO devices can degrade performance or trigger out-of-memory conditions in long-running servers or embedded devices; high ecosystem prevalence of the kernel increases exposure across many deployments.

How an attack unfolds

An attacker triggers repeated gpiochip registration paths that succeed at device_add() but later error, leaking memory each time; threat actors involved in 2024 Zero-Day Exploitation Campaigns or Linux kernel resource issues could combine this with other primitives to exhaust memory, though EPSS remains low and no KEV listing exists.

How to fix it

Upgrade the Linux kernel to a version containing commit 6c78684e84ba7f460aedba6f017760e2323fdf4b; ensure gcdev_register calls put_device() on error paths after device_add and avoid kcalloc on zero-length gpio counts.

How to confirm the fix worked

Run kmemleak or slabinfo before and after gpiochip registration tests; verify absence of unreferenced device_private objects and confirm gdev->descs is not allocated from ZERO_PTR.

Typical attack path

1. Identify systems exposing GPIO character devices
2. Trigger gpiolib_cdev_register paths that reach device_add()
3. Force error conditions after device_add succeeds
4. Repeat to accumulate unreleased allocations
5. Monitor for memory pressure or OOM events

How to detect it

Inspect kernel logs and kmemleak reports for unreferenced objects allocated via kmalloc_trace during device_add in gpiochip_setup_dev; correlate with python3 or other processes calling gpiochip_add_data_with_key.

What your security team should do

• Prioritize kernel updates on all systems using GPIO subsystems
• Enable CONFIG_DEBUG_KMEMLEAK and monitor for gpiochip_setup_dev leaks
• Review downstream dependents for custom GPIO drivers that may reintroduce the pattern
• Apply patches within standard maintenance windows given low EPSS and no ransomware usage