CVE-2022-48881: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-48881 affects the Linux kernel's AMD PMC driver, specifically related to a reference count leak in the amd_pmc_probe function. The vulnerability was discovered and disclosed in August 2024, affecting Linux kernel versions from 5.18 up to (excluding) 6.1.7 (NVD).

The vulnerability stems from improper reference counting in the amd_pmc_probe function. The issue occurs because pci_get_domain_bus_and_slot() takes a reference, but the caller fails to release it by calling pci_dev_put() after use in the error path. The vulnerability has been assigned a CVSS v3.1 base score of 7.1 HIGH with vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H (NVD).

The reference count leak in the AMD PMC driver could potentially lead to resource exhaustion and system instability. The CVSS score indicates that the vulnerability can result in high impacts to confidentiality and availability, requiring local access with low complexity to exploit (NVD).

The vulnerability has been patched by adding a proper call to pci_dev_put() in the error path. The fix was implemented through a kernel patch that modifies the error handling in the amd_pmc_probe function to properly release the reference when an error occurs (Kernel Patch).