CVE-2022-48637

What it actually does

Use-after-free vulnerability in the bnxt network driver where bnxt_tx_int() transfers skb ownership to a PTP worker thread without nulling the pointer, allowing the worker to free the skb before subsequent code references it.

Why it matters to the business

Systems running affected Linux kernels with bnxt hardware and PTP timestamping enabled risk kernel instability, crashes, or potential remote code execution that could disrupt network services and require emergency patching.

How an attack unfolds

An attacker triggers concurrent network transmission and PTP timestamp reads on bnxt hardware so that the PTP worker frees the skb while bnxt_tx_int() still holds a reference, resulting in use-after-free memory corruption.

How to fix it

Upgrade the Linux kernel to a version containing commit 08483e4c0c83b221b8891434a04cec405dee94a6 or later; apply the fix that sets skb to NULL after handing ownership to the PTP worker.

How to confirm the fix worked

Verify the running kernel contains commit 08483e4c0c83b221b8891434a04cec405dee94a6; inspect bnxt_tx_int() to confirm skb is nulled after PTP worker hand-off; test PTP timestamping under load to ensure no UAF occurs.

Typical attack path

1. Identify target systems using bnxt driver with PTP enabled
2. Send crafted network traffic that exercises tx completion and timestamp paths concurrently
3. Trigger skb hand-off race leading to UAF
4. Exploit resulting memory corruption for privilege escalation or denial of service

How to detect it

Search kernel logs for bnxt-related oops, use-after-free warnings, or skb pointer dereference faults around PTP worker activity; examine network traces showing PTP timestamp requests coinciding with high tx completion rates.

What your security team should do

• Prioritize kernel updates on all systems using bnxt network hardware
• Disable PTP timestamping on bnxt interfaces if immediate patching is not feasible
• Monitor for kernel oops or crashes related to bnxt and skb references
• Review downstream distributions for backported fixes