CVE-2022-48686

What it actually does

Use-after-free in the nvme-tcp io_work loop: when a digest error sets rd_enabled, the code continues attempting socket reads on a freed or out-of-sync TCP stream, allowing memory corruption.

Why it matters to the business

Systems using NVMe over TCP storage face risk of kernel crashes, data corruption, or local privilege escalation; the issue affects Linux distributions and downstream products with no widespread active exploitation reported.

How an attack unfolds

An attacker with local access crafts or intercepts an NVMe/TCP connection that triggers digest errors; the missing bail from the io_work loop then dereferences freed structures, leading to UAF and potential code execution.

How to fix it

Upgrade the Linux kernel to a version containing commit 1b426f58a513194206d0ea8ab58baf1461e54978 or 19816a0214684f70b49b25075ff8c402fdd611d3 (or later stable releases that include the fix). Reboot after installing the updated kernel package.

How to confirm the fix worked

Verify the running kernel git commit or package version contains the listed fix commits; inspect nvme-tcp.c for the rd_enabled bail logic; run regression tests that inject digest errors on NVMe/TCP connections.

Typical attack path

1. Obtain local access or control a process communicating over NVMe/TCP
2. Induce digest errors on the TCP stream (malformed frames or network manipulation)
3. Trigger the nvme-tcp io_work path without the rd_enabled bail condition
4. Reuse the freed socket or request structures to corrupt kernel memory
5. Escalate to arbitrary code execution or denial of service

How to detect it

Review kernel logs (dmesg, /var/log/kern.log) for nvme-tcp and digest error messages around the time of crashes; look for unexpected oops or use-after-free warnings in the nvme_tcp module; correlate with processes opening NVMe/TCP sockets.

What your security team should do

• Prioritize kernel updates on all hosts using NVMe over TCP within standard patch windows
• Confirm NVMe/TCP is in use via lspci or /proc or kernel config before elevating urgency
• Monitor vendor advisories for backported fixes in distribution kernels
• Apply compensating controls such as network segmentation for storage traffic if immediate patching is delayed