GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2022-48975 (GCVE-0-2022-48975)

Vulnerability from cvelistv5 – Published: 2024-10-21 20:05 – Updated: 2026-05-11 18:50
VLAI
Title
gpiolib: fix memory leak in gpiochip_setup_dev()
Summary
In the Linux kernel, the following vulnerability has been resolved: gpiolib: fix memory leak in gpiochip_setup_dev() Here is a backtrace report about memory leak detected in gpiochip_setup_dev(): unreferenced object 0xffff88810b406400 (size 512): comm "python3", pid 1682, jiffies 4295346908 (age 24.090s) backtrace: kmalloc_trace device_add device_private_init at drivers/base/core.c:3361 (inlined by) device_add at drivers/base/core.c:3411 cdev_device_add gpiolib_cdev_register gpiochip_setup_dev gpiochip_add_data_with_key gcdev_register() & gcdev_unregister() would call device_add() & device_del() (no matter CONFIG_GPIO_CDEV is enabled or not) to register/unregister device. However, if device_add() succeeds, some resource (like struct device_private allocated by device_private_init()) is not released by device_del(). Therefore, after device_add() succeeds by gcdev_register(), it needs to call put_device() to release resource in the error handle path. Here we move forward the register of release function, and let it release every piece of resource by put_device() instead of kfree(). While at it, fix another subtle issue, i.e. when gc->ngpio is equal to 0, we still call kcalloc() and, in case of further error, kfree() on the ZERO_PTR pointer, which is not NULL. It's not a bug per se, but rather waste of the resources and potentially wrong expectation about contents of the gdev->descs variable.
Severity
No CVSS data available.
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-10-22 13:18 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 159f3cd92f17c61a4e2a47456de5865b114ef88e , < 6daaa84b621485fe28c401be18debf92ae8ef04a (git)
Affected: 159f3cd92f17c61a4e2a47456de5865b114ef88e , < 371363716398ed718e389bea8c5e9843a79dde4e (git)
Affected: 159f3cd92f17c61a4e2a47456de5865b114ef88e , < ec851b23084b3a0af8bf0f5e51d33a8d678bdc49 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.6
Unaffected: 0 , < 4.6 (semver)
Unaffected: 5.15.83 , ≤ 5.15.* (semver)
Unaffected: 6.0.13 , ≤ 6.0.* (semver)
Unaffected: 6.1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-48975",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-22T13:18:35.922105Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-22T13:28:37.208Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpio/gpiolib.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6daaa84b621485fe28c401be18debf92ae8ef04a",
              "status": "affected",
              "version": "159f3cd92f17c61a4e2a47456de5865b114ef88e",
              "versionType": "git"
            },
            {
              "lessThan": "371363716398ed718e389bea8c5e9843a79dde4e",
              "status": "affected",
              "version": "159f3cd92f17c61a4e2a47456de5865b114ef88e",
              "versionType": "git"
            },
            {
              "lessThan": "ec851b23084b3a0af8bf0f5e51d33a8d678bdc49",
              "status": "affected",
              "version": "159f3cd92f17c61a4e2a47456de5865b114ef88e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpio/gpiolib.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.6"
            },
            {
              "lessThan": "4.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.83",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.0.*",
              "status": "unaffected",
              "version": "6.0.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.83",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0.13",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngpiolib: fix memory leak in gpiochip_setup_dev()\n\nHere is a backtrace report about memory leak detected in\ngpiochip_setup_dev():\n\nunreferenced object 0xffff88810b406400 (size 512):\n  comm \"python3\", pid 1682, jiffies 4295346908 (age 24.090s)\n  backtrace:\n    kmalloc_trace\n    device_add\t\tdevice_private_init at drivers/base/core.c:3361\n\t\t\t(inlined by) device_add at drivers/base/core.c:3411\n    cdev_device_add\n    gpiolib_cdev_register\n    gpiochip_setup_dev\n    gpiochip_add_data_with_key\n\ngcdev_register() \u0026 gcdev_unregister() would call device_add() \u0026\ndevice_del() (no matter CONFIG_GPIO_CDEV is enabled or not) to\nregister/unregister device.\n\nHowever, if device_add() succeeds, some resource (like\nstruct device_private allocated by device_private_init())\nis not released by device_del().\n\nTherefore, after device_add() succeeds by gcdev_register(), it\nneeds to call put_device() to release resource in the error handle\npath.\n\nHere we move forward the register of release function, and let it\nrelease every piece of resource by put_device() instead of kfree().\n\nWhile at it, fix another subtle issue, i.e. when gc-\u003engpio is equal\nto 0, we still call kcalloc() and, in case of further error, kfree()\non the ZERO_PTR pointer, which is not NULL. It\u0027s not a bug per se,\nbut rather waste of the resources and potentially wrong expectation\nabout contents of the gdev-\u003edescs variable."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T18:50:46.796Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/6daaa84b621485fe28c401be18debf92ae8ef04a"
        },
        {
          "url": "https://git.kernel.org/stable/c/371363716398ed718e389bea8c5e9843a79dde4e"
        },
        {
          "url": "https://git.kernel.org/stable/c/ec851b23084b3a0af8bf0f5e51d33a8d678bdc49"
        }
      ],
      "title": "gpiolib: fix memory leak in gpiochip_setup_dev()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-48975",
    "datePublished": "2024-10-21T20:05:55.091Z",
    "dateReserved": "2024-08-22T01:27:53.631Z",
    "dateUpdated": "2026-05-11T18:50:46.796Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-48975",
      "date": "2026-09-16",
      "epss": "0.00245",
      "percentile": "0.15964"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"4.6\", \"versionEndExcluding\": \"5.15.83\", \"matchCriteriaId\": \"DF176C32-811C-421C-964D-E3513DD1789F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.16\", \"versionEndExcluding\": \"6.0.13\", \"matchCriteriaId\": \"389392A7-81C4-4C26-884B-8C7CF0F53DA4\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.1:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"E7E331DA-1FB0-4DEC-91AC-7DA69D461C11\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.1:rc2:*:*:*:*:*:*\", \"matchCriteriaId\": \"17F0B248-42CF-4AE6-A469-BB1BAE7F4705\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.1:rc3:*:*:*:*:*:*\", \"matchCriteriaId\": \"E2422816-0C14-4B5E-A1E6-A9D776E5C49B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.1:rc4:*:*:*:*:*:*\", \"matchCriteriaId\": \"1C6E00FE-5FB9-4D20-A1A1-5A32128F9B76\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.1:rc5:*:*:*:*:*:*\", \"matchCriteriaId\": \"35B26BE4-43A6-4A36-A7F6-5B3F572D9186\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.1:rc6:*:*:*:*:*:*\", \"matchCriteriaId\": \"3FFFB0B3-930D-408A-91E2-BAE0C2715D80\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.1:rc7:*:*:*:*:*:*\", \"matchCriteriaId\": \"8535320E-A0DB-4277-800E-D0CE5BBA59E8\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.1:rc8:*:*:*:*:*:*\", \"matchCriteriaId\": \"21718AA4-4056-40F2-968E-BDAA465A7872\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ngpiolib: fix memory leak in gpiochip_setup_dev()\\n\\nHere is a backtrace report about memory leak detected in\\ngpiochip_setup_dev():\\n\\nunreferenced object 0xffff88810b406400 (size 512):\\n  comm \\\"python3\\\", pid 1682, jiffies 4295346908 (age 24.090s)\\n  backtrace:\\n    kmalloc_trace\\n    device_add\\t\\tdevice_private_init at drivers/base/core.c:3361\\n\\t\\t\\t(inlined by) device_add at drivers/base/core.c:3411\\n    cdev_device_add\\n    gpiolib_cdev_register\\n    gpiochip_setup_dev\\n    gpiochip_add_data_with_key\\n\\ngcdev_register() \u0026 gcdev_unregister() would call device_add() \u0026\\ndevice_del() (no matter CONFIG_GPIO_CDEV is enabled or not) to\\nregister/unregister device.\\n\\nHowever, if device_add() succeeds, some resource (like\\nstruct device_private allocated by device_private_init())\\nis not released by device_del().\\n\\nTherefore, after device_add() succeeds by gcdev_register(), it\\nneeds to call put_device() to release resource in the error handle\\npath.\\n\\nHere we move forward the register of release function, and let it\\nrelease every piece of resource by put_device() instead of kfree().\\n\\nWhile at it, fix another subtle issue, i.e. when gc-\u003engpio is equal\\nto 0, we still call kcalloc() and, in case of further error, kfree()\\non the ZERO_PTR pointer, which is not NULL. It\u0027s not a bug per se,\\nbut rather waste of the resources and potentially wrong expectation\\nabout contents of the gdev-\u003edescs variable.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: gpiolib: reparar p\\u00e9rdida de memoria en gpiochip_setup_dev() Aqu\\u00ed hay un informe de seguimiento sobre la p\\u00e9rdida de memoria detectada en gpiochip_setup_dev(): objeto sin referencia 0xffff88810b406400 (tama\\u00f1o 512): comm \\\"python3\\\", pid 1682, jiffies 4295346908 (edad 24.090s) seguimiento: kmalloc_trace device_add device_private_init en drivers/base/core.c:3361 (en l\\u00ednea por) device_add en drivers/base/core.c:3411 cdev_device_add gpiolib_cdev_register gpiochip_setup_dev gpiochip_add_data_with_key gcdev_register() y gcdev_unregister() llamar\\u00edan device_add() y device_del() (sin importar si CONFIG_GPIO_CDEV est\\u00e1 habilitado o no) para registrar/anular el registro del dispositivo. Sin embargo, si device_add() tiene \\u00e9xito, alg\\u00fan recurso (como la estructura device_private asignada por device_private_init()) no es liberado por device_del(). Por lo tanto, despu\\u00e9s de que device_add() tenga \\u00e9xito por gcdev_register(), necesita llamar a put_device() para liberar el recurso en la ruta del controlador de error. Aqu\\u00ed avanzamos el registro de la funci\\u00f3n de liberaci\\u00f3n y dejamos que libere cada pieza de recurso por put_device() en lugar de kfree(). Mientras lo hacemos, solucionamos otro problema sutil, es decir, cuando gc-\u0026gt;ngpio es igual a 0, todav\\u00eda llamamos a kcalloc() y, en caso de un error adicional, a kfree() en el puntero ZERO_PTR, que no es NULL. No es un error en s\\u00ed, sino m\\u00e1s bien un desperdicio de recursos y una expectativa potencialmente err\\u00f3nea sobre el contenido de la variable gdev-\u0026gt;descs.\"}]",
      "id": "CVE-2022-48975",
      "lastModified": "2024-10-25T18:48:57.490",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 5.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 3.6}]}",
      "published": "2024-10-21T20:15:09.597",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/371363716398ed718e389bea8c5e9843a79dde4e\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/6daaa84b621485fe28c401be18debf92ae8ef04a\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/ec851b23084b3a0af8bf0f5e51d33a8d678bdc49\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Analyzed",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-401\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-48975\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-10-21T20:15:09.597\",\"lastModified\":\"2026-06-17T05:16:45.373\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ngpiolib: fix memory leak in gpiochip_setup_dev()\\n\\nHere is a backtrace report about memory leak detected in\\ngpiochip_setup_dev():\\n\\nunreferenced object 0xffff88810b406400 (size 512):\\n  comm \\\"python3\\\", pid 1682, jiffies 4295346908 (age 24.090s)\\n  backtrace:\\n    kmalloc_trace\\n    device_add\\t\\tdevice_private_init at drivers/base/core.c:3361\\n\\t\\t\\t(inlined by) device_add at drivers/base/core.c:3411\\n    cdev_device_add\\n    gpiolib_cdev_register\\n    gpiochip_setup_dev\\n    gpiochip_add_data_with_key\\n\\ngcdev_register() \u0026 gcdev_unregister() would call device_add() \u0026\\ndevice_del() (no matter CONFIG_GPIO_CDEV is enabled or not) to\\nregister/unregister device.\\n\\nHowever, if device_add() succeeds, some resource (like\\nstruct device_private allocated by device_private_init())\\nis not released by device_del().\\n\\nTherefore, after device_add() succeeds by gcdev_register(), it\\nneeds to call put_device() to release resource in the error handle\\npath.\\n\\nHere we move forward the register of release function, and let it\\nrelease every piece of resource by put_device() instead of kfree().\\n\\nWhile at it, fix another subtle issue, i.e. when gc-\u003engpio is equal\\nto 0, we still call kcalloc() and, in case of further error, kfree()\\non the ZERO_PTR pointer, which is not NULL. It\u0027s not a bug per se,\\nbut rather waste of the resources and potentially wrong expectation\\nabout contents of the gdev-\u003edescs variable.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: gpiolib: reparar p\u00e9rdida de memoria en gpiochip_setup_dev() Aqu\u00ed hay un informe de seguimiento sobre la p\u00e9rdida de memoria detectada en gpiochip_setup_dev(): objeto sin referencia 0xffff88810b406400 (tama\u00f1o 512): comm \\\"python3\\\", pid 1682, jiffies 4295346908 (edad 24.090s) seguimiento: kmalloc_trace device_add device_private_init en drivers/base/core.c:3361 (en l\u00ednea por) device_add en drivers/base/core.c:3411 cdev_device_add gpiolib_cdev_register gpiochip_setup_dev gpiochip_add_data_with_key gcdev_register() y gcdev_unregister() llamar\u00edan device_add() y device_del() (sin importar si CONFIG_GPIO_CDEV est\u00e1 habilitado o no) para registrar/anular el registro del dispositivo. Sin embargo, si device_add() tiene \u00e9xito, alg\u00fan recurso (como la estructura device_private asignada por device_private_init()) no es liberado por device_del(). Por lo tanto, despu\u00e9s de que device_add() tenga \u00e9xito por gcdev_register(), necesita llamar a put_device() para liberar el recurso en la ruta del controlador de error. Aqu\u00ed avanzamos el registro de la funci\u00f3n de liberaci\u00f3n y dejamos que libere cada pieza de recurso por put_device() en lugar de kfree(). Mientras lo hacemos, solucionamos otro problema sutil, es decir, cuando gc-\u0026gt;ngpio es igual a 0, todav\u00eda llamamos a kcalloc() y, en caso de un error adicional, a kfree() en el puntero ZERO_PTR, que no es NULL. No es un error en s\u00ed, sino m\u00e1s bien un desperdicio de recursos y una expectativa potencialmente err\u00f3nea sobre el contenido de la variable gdev-\u0026gt;descs.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/gpio/gpiolib.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"159f3cd92f17c61a4e2a47456de5865b114ef88e\",\"lessThan\":\"6daaa84b621485fe28c401be18debf92ae8ef04a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"159f3cd92f17c61a4e2a47456de5865b114ef88e\",\"lessThan\":\"371363716398ed718e389bea8c5e9843a79dde4e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"159f3cd92f17c61a4e2a47456de5865b114ef88e\",\"lessThan\":\"ec851b23084b3a0af8bf0f5e51d33a8d678bdc49\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/gpio/gpiolib.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.6\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.6\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.83\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.0.13\",\"lessThanOrEqual\":\"6.0.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-10-22T13:18:35.922105Z\",\"id\":\"CVE-2022-48975\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-401\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.6\",\"versionEndExcluding\":\"5.15.83\",\"matchCriteriaId\":\"DF176C32-811C-421C-964D-E3513DD1789F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.0.13\",\"matchCriteriaId\":\"389392A7-81C4-4C26-884B-8C7CF0F53DA4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.1:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"E7E331DA-1FB0-4DEC-91AC-7DA69D461C11\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.1:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"17F0B248-42CF-4AE6-A469-BB1BAE7F4705\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.1:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"E2422816-0C14-4B5E-A1E6-A9D776E5C49B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.1:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"1C6E00FE-5FB9-4D20-A1A1-5A32128F9B76\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.1:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"35B26BE4-43A6-4A36-A7F6-5B3F572D9186\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.1:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"3FFFB0B3-930D-408A-91E2-BAE0C2715D80\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.1:rc7:*:*:*:*:*:*\",\"matchCriteriaId\":\"8535320E-A0DB-4277-800E-D0CE5BBA59E8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.1:rc8:*:*:*:*:*:*\",\"matchCriteriaId\":\"21718AA4-4056-40F2-968E-BDAA465A7872\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/371363716398ed718e389bea8c5e9843a79dde4e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/6daaa84b621485fe28c401be18debf92ae8ef04a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ec851b23084b3a0af8bf0f5e51d33a8d678bdc49\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-13T18:18:06+00:00",
      "cve": "CVE-2022-48975",
      "id": "CVE-2022-48975",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:known_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: gpiolib: fix memory leak in gpiochip_setup_dev()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-48975.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-16T00:27:35Z",
      "cve": "CVE-2022-48975",
      "id": "CVE-2022-48975",
      "initial_release_date": "2024-10-22T14:23:00Z",
      "product_status:known_affected": "406",
      "product_status:known_not_affected": "277",
      "product_status:recommended": "449",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2022-48975",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2022-48975.json",
      "version": "53"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2022-48975\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-10-22T13:18:35.922105Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-10-22T13:18:39.820Z\"}}], \"cna\": {\"title\": \"gpiolib: fix memory leak in gpiochip_setup_dev()\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"159f3cd92f17c61a4e2a47456de5865b114ef88e\", \"lessThan\": \"6daaa84b621485fe28c401be18debf92ae8ef04a\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"159f3cd92f17c61a4e2a47456de5865b114ef88e\", \"lessThan\": \"371363716398ed718e389bea8c5e9843a79dde4e\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"159f3cd92f17c61a4e2a47456de5865b114ef88e\", \"lessThan\": \"ec851b23084b3a0af8bf0f5e51d33a8d678bdc49\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/gpio/gpiolib.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.6\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"4.6\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.15.83\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.0.13\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.0.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/gpio/gpiolib.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/6daaa84b621485fe28c401be18debf92ae8ef04a\"}, {\"url\": \"https://git.kernel.org/stable/c/371363716398ed718e389bea8c5e9843a79dde4e\"}, {\"url\": \"https://git.kernel.org/stable/c/ec851b23084b3a0af8bf0f5e51d33a8d678bdc49\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ngpiolib: fix memory leak in gpiochip_setup_dev()\\n\\nHere is a backtrace report about memory leak detected in\\ngpiochip_setup_dev():\\n\\nunreferenced object 0xffff88810b406400 (size 512):\\n  comm \\\"python3\\\", pid 1682, jiffies 4295346908 (age 24.090s)\\n  backtrace:\\n    kmalloc_trace\\n    device_add\\t\\tdevice_private_init at drivers/base/core.c:3361\\n\\t\\t\\t(inlined by) device_add at drivers/base/core.c:3411\\n    cdev_device_add\\n    gpiolib_cdev_register\\n    gpiochip_setup_dev\\n    gpiochip_add_data_with_key\\n\\ngcdev_register() \u0026 gcdev_unregister() would call device_add() \u0026\\ndevice_del() (no matter CONFIG_GPIO_CDEV is enabled or not) to\\nregister/unregister device.\\n\\nHowever, if device_add() succeeds, some resource (like\\nstruct device_private allocated by device_private_init())\\nis not released by device_del().\\n\\nTherefore, after device_add() succeeds by gcdev_register(), it\\nneeds to call put_device() to release resource in the error handle\\npath.\\n\\nHere we move forward the register of release function, and let it\\nrelease every piece of resource by put_device() instead of kfree().\\n\\nWhile at it, fix another subtle issue, i.e. when gc-\u003engpio is equal\\nto 0, we still call kcalloc() and, in case of further error, kfree()\\non the ZERO_PTR pointer, which is not NULL. It\u0027s not a bug per se,\\nbut rather waste of the resources and potentially wrong expectation\\nabout contents of the gdev-\u003edescs variable.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.83\", \"versionStartIncluding\": \"4.6\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.0.13\", \"versionStartIncluding\": \"4.6\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1\", \"versionStartIncluding\": \"4.6\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-05-11T18:50:46.796Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2022-48975\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-11T18:50:46.796Z\", \"dateReserved\": \"2024-08-22T01:27:53.631Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-10-21T20:05:55.091Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.