CVE-2022-48715

What it actually does

The bnx2fc_recv_frame() function updates per-CPU lport statistics counters without disabling preemption, allowing smp_processor_id() to be called from preemptible context and triggering BUG warnings on debug kernels.

Why it matters to the business

Systems using the bnx2fc driver may experience kernel warnings, reduced stability, or unexpected behavior during normal network receive processing; the issue has been present for years with no known active exploitation campaigns.

How an attack unfolds

An attacker with the ability to send crafted frames to a system running the vulnerable bnx2fc driver could trigger the receive path concurrently with preemption events, exposing the unsafe per-CPU counter updates; no named threat actors have been observed exploiting this flaw.

How to fix it

Upgrade the Linux kernel to a version containing commit 3a345198a7c2d1db2526dc60b77052f75de019d3 which restores get_cpu/put_cpu usage with a minimized critical section.

How to confirm the fix worked

Boot a debug kernel, load the bnx2fc driver, and confirm absence of the smp_processor_id() preemptible code warning when receiving frames; verify the commit is present in the running kernel source.

Typical attack path

1. Identify a target system with the bnx2fc driver loaded and hardware enabled.
2. Send network frames that exercise the bnx2fc_l2_rcv_thread receive path.
3. Force preemption during the stats counter modification inside bnx2fc_recv_frame().
4. Observe kernel BUG or warning output on debug builds.

How to detect it

Review kernel logs for the specific BUG message referencing bnx2fc_recv_frame and smp_processor_id in preemptible context; no post-exploitation artifacts are expected.

What your security team should do

• Prioritize kernel upgrades on any systems exposing the bnx2fc driver to network traffic.
• Monitor vendor advisories for backported fixes in distribution kernels.
• Test the updated kernel in a staging environment before production rollout.