CVE-2022-48697

What it actually does

Use-after-free in nvmet request completion path allowing invalid memory access during blk_mq_complete_request_remote when nvme_loop workqueue processes IO connect operations.

Why it matters to the business

Linux systems handling NVMe target traffic may experience kernel crashes, denial of service, or potential memory corruption leading to service outages in storage environments.

How an attack unfolds

An attacker sends crafted NVMe connect requests that trigger the nvmet execute path; the resulting work item races with request completion leaving a dangling reference that is later dereferenced in the completion handler.

How to fix it

Upgrade the Linux kernel to a version containing commit 17f121ca3ec6be0fb32d77c7f65362934a38cc8e or later; rebuild and reboot affected systems; apply vendor-supplied kernel packages that include the nvmet fix.

How to confirm the fix worked

Verify the running kernel contains commit 17f121ca3ec6be0fb32d77c7f65362934a38cc8e via git log or uname output; re-run blktests nvme/004 to confirm absence of the KASAN report; monitor for stable kernel updates beyond the listed fixed commit.

Typical attack path

1. Establish NVMe loop or target connection to the vulnerable kernel
2. Issue nvme io-connect commands that invoke nvmet_execute_io_connect
3. Trigger concurrent request completion via nvmet-wq
4. Force the use-after-free by completing the request after the structure has been freed
5. Observe kernel panic or attempt to corrupt memory for code execution

How to detect it

Search kernel logs for KASAN reports referencing blk_mq_complete_request_remote combined with nvme_loop_execute_work; inspect workqueue activity and stack traces showing nvmet_req_complete after a freed nvmet request structure.

What your security team should do

• Prioritize kernel upgrades on all systems exposing NVMe target functionality
• Disable nvme_loop module if NVMe target is not required
• Monitor vendor advisories for backported fixes in supported distributions
• Test the fix in a staging environment before broad deployment