CVE-2022-48965: 
Linux Debian vulnerability analysis and mitigation

CVE-2022-48965 is a vulnerability in the Linux kernel affecting the GPIO/Rockchip driver. The issue was discovered in the rockchip_gpiolib_register() function where a reference count leak occurs. This vulnerability affects Linux kernel versions from 5.15 through 5.15.83 and from 5.16 through 6.0.13, as well as various 6.1 release candidates (rc1-rc8) (CVE Mitre).

The vulnerability stems from a missing reference count decrement in the rockchip_gpiolib_register() function. Specifically, the node returned by of_get_parent() has its reference count incremented, but of_node_put() was not being called when finished using it. This creates a reference count leak in the kernel's memory management system. The vulnerability has been assigned a CVSS v3.1 base score of 5.5, indicating moderate severity with local attack vector (Red Hat).

The vulnerability can lead to a resource leak in the Linux kernel's GPIO subsystem for Rockchip devices. While there is no direct impact on confidentiality or integrity, it can affect system availability by causing resource exhaustion over time (Red Hat).

The vulnerability has been fixed by adding an of_node_put(pctlnp) call at the end of the of_pinctrl_get() function. The fix has been implemented in the Linux kernel through various patches (Kernel Patch).