CVE-2022-48673

What it actually does

Use-after-free in net/smc link clear path: QP is transitioned to error state and immediately destroyed without waiting for pending RX work completions (IB_WC_WR_FLUSH_ERR), allowing the tasklet smc_wr_rx_tasklet_fn to dereference freed memory.

Why it matters to the business

Kernel panic or denial of service on systems using SMC over RoCE/IB, causing unplanned reboots, service outages, and potential data corruption in high-availability or clustered environments; urgency is moderate given 897 days since publication and low EPSS.

How an attack unfolds

An attacker with local access triggers repeated SMC connection setup/teardown or QP error transitions; the race between the freed link group and the still-scheduled tasklet leads to invalid memory access, most often manifesting as a crash rather than controlled execution.

How to fix it

Upgrade the linux package on Debian 11 to version 5.10.178-1 or newer; rebuild and reboot into the fixed kernel; if SMC is not required, disable the smc module via modprobe.blacklist.

How to confirm the fix worked

Verify running kernel version is >= 5.10.178-1; confirm absence of the vulnerable smc_wr_rx_tasklet_fn and link-clear code paths via source or binary inspection; test SMC connection teardown under load to ensure no crashes occur.

Typical attack path

1. Obtain local code execution on target (user or container context)
2. Create or manipulate SMC sockets to drive link group allocation
3. Force QP state transition to Error (e.g., via network or device events)
4. Trigger immediate link group destruction before tasklet drains completions
5. Tasklet executes on freed memory, causing oops in mlx5_ib_poll_cq or spinlock paths

How to detect it

Search kernel logs for oops involving smc_wr_rx_tasklet_fn, mlx5_ib_poll_cq, native_queued_spin_lock_slowpath, and page faults referencing freed SMC link structures; correlate with tasklet_action_common and irq_exit entries around SMC socket close events.

• smc_wr_rx_tasklet_fn
• BUG: unable to handle page fault for address
• mlx5_ib_poll_cq
• native_queued_spin_lock_slowpath
• tasklet_action_common.isra

What your security team should do

• Apply the 5.10.178-1 kernel update within standard change windows
• Monitor for SMC-related kernel oops in production workloads
• Evaluate disabling SMC if the protocol is not explicitly used
• Include the fixed kernel in golden images and automated deployment pipelines