CVE-2022-48658

What it actually does

The vulnerability permits a WQ_MEM_RECLAIM workqueue to flush the global non-reclaim events workqueue during flush_all_cpus_locked() invoked from task context in SLUB slab cache shutdown, violating workqueue dependency rules and triggering warnings or potential deadlocks in __free_slab() paths.

Why it matters to the business

Kernel instability or crashes can occur during storage controller teardown or memory cache destruction on affected Linux systems, reducing availability especially in NVMe or real-time kernel deployments and increasing operational risk until patched.

How an attack unfolds

A local attacker triggers kmem_cache_destroy paths (for example via NVMe FC controller free operations) that call flush_all_cpus_locked() from task context, causing the reclaim workqueue dependency violation that may be leveraged to induce denial of service or escalate privileges through resulting kernel state corruption.

How to fix it

Apply the upstream fix by updating to the kernel commit 61703b248be993eb4997b00ae5d3318e6d8f3c5b or a stable release containing the new WQ_MEM_RECLAIM workqueue dedicated to flush_cpu_slab operations; rebuild and reboot with the corrected kernel.

How to confirm the fix worked

Confirm the presence of the dedicated flush workqueue with WQ_MEM_RECLAIM set in mm/slub.c and verify absence of check_flush_dependency warnings during kmem_cache_shutdown or bioset_exit sequences on test workloads.

Typical attack path

1. Gain local user or process access on an affected Linux system
2. Initiate operations that destroy slab caches or release block queues (such as NVMe controller deletion)
3. Trigger flush_cpu_slab workqueue execution from task context to violate WQ_MEM_RECLAIM dependency
4. Exploit resulting warning, deadlock, or memory state for denial of service or further attack

How to detect it

Search kernel ring buffers and logs for check_flush_dependency warnings, flush_cpu_slab invocations from nvme-delete-wq or similar reclaim contexts, and stack traces containing __kmem_cache_shutdown or bioset_exit during controller teardown.

• check_flush_dependency+0x10a/0x120
• flush_cpu_slab
• nvme-delete-wq:nvme_delete_ctrl_work
• WARNING: CPU.*at kernel/workqueue.c:2637

What your security team should do

• Immediately schedule kernel upgrades to the fixed commit on all affected hosts
• Monitor kernel logs for workqueue dependency warnings involving flush_cpu_slab
• Limit untrusted local code execution on systems running vulnerable kernels
• Test patched kernels in staging environments that exercise NVMe and slab cache teardown paths