CVE-2022-48973

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

gpio: amd8111: Fix PCI device reference count leak

for_each_pci_dev() is implemented by pci_get_device(). The comment of pci_get_device() says that it will increase the reference count for the returned pci_dev and also decrease the reference count for the input pci_dev @from if it is not NULL.

If we break for_each_pci_dev() loop with pdev not NULL, we need to call pci_dev_put() to decrease the reference count. Add the missing pci_dev_put() after the 'out' label. Since pci_dev_put() can handle NULL input parameter, there is no problem for the 'Device not found' branch. For the normal path, add pci_dev_put() in amd_gpio_exit().

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected software

VendorProductVersions
LinuxLinux>= f942a7de047d8c599cc1a9a26293c8c7400450ea, < 4749c5cc147c9860b96db1e71cc36d1de1bd3f59; >= f942a7de047d8c599cc1a9a26293c8c7400450ea, < 71d591ef873f9ebb86cd8d053b3caee785b2de6a; >= f942a7de047d8c599cc1a9a26293c8c7400450ea, < b2bc053ebbba57a06fa655db5ea796de2edce445; >= f942a7de047d8c599cc1a9a26293c8c7400450ea, < 48bd5d3801f6b67cc144449d434abbd5043a6d37; >= f942a7de047d8c599cc1a9a26293c8c7400450ea, < 5ee6413d3dd972930af787b2c0c7aaeb379fa521; >= f942a7de047d8c599cc1a9a26293c8c7400450ea, < 4271515f189bd5fe2ec86b4089dab7cb804625d2; >= f942a7de047d8c599cc1a9a26293c8c7400450ea, < e364ce04d8f840478b09eee57b614de7cf1e743e; >= f942a7de047d8c599cc1a9a26293c8c7400450ea, < 45fecdb9f658d9c82960c98240bc0770ade19aca
LinuxLinux3.6

References

Timeline

Published
Oct 21, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2022

CVE-2022-489745.5In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: fix using __this_cpu_add in preemptible CurrentlCVE-2022-489755.5In the Linux kernel, the following vulnerability has been resolved: gpiolib: fix memory leak in gpiochip_setup_dev() Here is a backtrace rCVE-2022-489765.5In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable_offload: fix using __this_cpu_add in preemptible CVE-2022-489775.5In the Linux kernel, the following vulnerability has been resolved: can: af_can: fix NULL pointer dereference in can_rcv_filter Analogue tCVE-2022-489785.5In the Linux kernel, the following vulnerability has been resolved: HID: core: fix shift-out-of-bounds in hid_report_raw_event Syzbot repoCVE-2022-489795.5In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: fix array index out of bound error in DCN32 DML [Why&CVE-2022-48985.4In affected versions of Octopus Server the help sidebar can be customized to include a Cross-Site Scripting payload in the support link. ThiCVE-2022-489807.8In the Linux kernel, the following vulnerability has been resolved: net: dsa: sja1105: avoid out of bounds access in sja1105_init_l2_policiCVE-2022-489817.8In the Linux kernel, the following vulnerability has been resolved: drm/shmem-helper: Remove errant put in error path drm_gem_shmem_mmap()CVE-2022-489825.5In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix crash when replugging CSR fake controllers It seems fakCVE-2022-489835.5In the Linux kernel, the following vulnerability has been resolved: io_uring: Fix a null-ptr-deref in io_tctx_exit_cb() Syzkaller reports CVE-2022-489845.5In the Linux kernel, the following vulnerability has been resolved: can: slcan: fix freed work crash The LTP test pty03 is causing a crash
CVE-2022-48973: Medium severity, CVSS 5.5 | Vulnix