CVE-2022-48820: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-48820 affects the Linux kernel and involves a refcount leak vulnerability in the stm32_usbphyc_pll_enable() function. The vulnerability was discovered in January 2022 and affects Linux kernel versions from 5.12 up to (excluding) 5.15.24, versions from 5.16 up to (excluding) 5.16.10, and 5.17 release candidates (rc1, rc2, rc3) (NVD).

The vulnerability stems from an error path in the stm32_usbphyc_pll_enable() function that fails to decrement the 'usbphyc->n_pll_cons.counter' before returning. This issue was introduced in commit 5b1af71280ab ('phy: stm32: rework PLL Lock detection') and was later fixed by modifying the error handling path to properly decrement the counter (Kernel Patch). The vulnerability has been assigned a CVSS v3.1 base score of 7.1 (High), with vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H (NVD).

The vulnerability could lead to a reference counter leak in the Linux kernel's USB PHY controller for STM32 devices. This could potentially result in resource exhaustion and affect system availability and confidentiality (NVD).

The vulnerability requires local access with low privileges to exploit. No active exploits have been reported in the wild (NVD).

The vulnerability has been fixed in the Linux kernel through a patch that properly decrements the counter in the error path. The fix was implemented in commit cfc826c88a79e22ba5d8001556eb2c7efd8a01b6 and has been backported to affected stable kernel versions (Kernel Patch).