CVE-2022-48975 addresses a memory leak vulnerability in the Linux kernel's GPIO subsystem, specifically within the gpiochip_setup_dev() function. The issue arises during the registration and unregistration of GPIO character devices (gcdev_register and gcdev_unregister). When device_add() succeeds, the associated resources, such as struct device_private allocated by device_private_init(), are not properly released by device_del(). This leads to a memory leak because put_device() is not called in the error handling path after device_add() succeeds. Additionally, the vulnerability includes a suboptimal handling of the gc->ngpio parameter when it is zero. In this case, kcalloc() is still called, and if an error occurs, kfree() is called on a ZERO_PTR pointer, which is not NULL. While not a direct bug, this behavior wastes resources and may cause incorrect assumptions about the contents of the gdev->descs variable. The fix involves moving the registration of the release function forward and ensuring that put_device() is called to release all allocated resources instead of directly calling kfree(). This vulnerability is a resource management flaw that could lead to a gradual increase in kernel memory usage, potentially affecting system stability over time. It does not appear to be exploitable for privilege escalation or code execution, and no known exploits are reported in the wild as of now.

For European organizations, the impact of this vulnerability is primarily related to system stability and reliability rather than direct compromise of confidentiality or integrity. Systems running affected Linux kernel versions that utilize GPIO character devices could experience memory leaks, which may lead to degraded performance or eventual system crashes if the leak is sustained over time. This is particularly relevant for embedded systems, industrial control systems, IoT devices, and other specialized hardware platforms common in manufacturing, automotive, telecommunications, and critical infrastructure sectors prevalent in Europe. Organizations relying on Linux-based systems for operational technology (OT) or edge computing should be aware that prolonged uptime without patching could result in service interruptions. Although this vulnerability does not enable direct remote exploitation or privilege escalation, the indirect effects on availability could disrupt business operations and critical services, especially in environments where uptime and reliability are paramount.

To mitigate CVE-2022-48975, organizations should prioritize updating their Linux kernel to a version that includes the fix for this memory leak vulnerability. Kernel patches addressing this issue have been published and should be applied promptly. For environments where immediate patching is not feasible, monitoring system memory usage related to GPIO device management can help detect abnormal resource consumption early. Administrators should audit the usage of GPIO character devices and consider disabling or limiting their use if not required. Additionally, implementing robust system monitoring and alerting for kernel memory leaks or unusual device registration failures can provide early warning signs. For embedded and IoT devices, coordinate with hardware vendors to obtain updated firmware or kernel versions incorporating the fix. Finally, ensure that development and testing environments include this patch to prevent introduction of the vulnerability in custom Linux kernel builds.