CVE-2022-48626

What it actually does

Use-after-free in moxart_remove() where the mmc host structure is accessed after being freed via pointer dereference instead of a saved base register.

Why it matters to the business

Local attackers on affected Linux systems can trigger kernel crashes, memory corruption, or potential privilege escalation when the moxart driver is removed, affecting device stability and security on embedded or legacy hardware using this driver.

How an attack unfolds

An attacker with local access loads or unloads the moxart driver module in a way that exercises the remove path, causing the kernel to dereference a freed structure and potentially corrupt memory for further exploitation.

How to fix it

Update the Linux kernel to the fixed commit f5dc193167591e88797262ec78515a0cbe79ff5f or later stable releases that backport the change of saving the device base register instead of dereferencing the freed structure.

How to confirm the fix worked

Verify kernel source contains commit f5dc193167591e88797262ec78515a0cbe79ff5f; confirm moxart_remove() no longer dereferences the host pointer after free; test driver load/unload cycles for stability.

Typical attack path

1. Obtain local user access on target system
2. Trigger moxart driver removal or module unload
3. Kernel performs moxart_remove() and accesses freed mmc host pointer
4. Attacker leverages resulting memory corruption for escalation or denial of service

How to detect it

Review kernel logs for oops/panic traces mentioning moxart_remove or mmc host structures; inspect module unload events coinciding with crashes; search audit logs for unexpected moxart module operations.

What your security team should do

• Prioritize kernel upgrade on systems using moxart MMC hardware
• Restrict local module loading privileges where possible
• Monitor for kernel oops or panic events related to moxart
• Apply the fix in custom or downstream kernel builds immediately