CVE-2022-48975

A flaw was found in the Linux kernel's General Purpose Input/Output (GPIO) library (gpiolib). This vulnerability, located in the gpiochip_setup_dev() function, results from resources not being properly released during error handling after a device is added. This oversight can lead to a gradual waste of system memory resources.

Red Hat has evaluated this issue as having a Moderate security impact because triggering the memory leak requires an error during the device registration path of a GPIO controller, which generally necessitates privileged operations or interaction with specific hardware interfaces. In typical Red Hat Enterprise Linux server and cloud deployments, unprivileged users lack the capability to repeatedly register or probe GPIO devices. Consequently, any risk of memory exhaustion is constrained to scenarios where an attacker already possesses elevated administrative privileges or physical access to attach specialized peripheral devices.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.