CVE-2022-48720

What it actually does

The flaw causes a resource leak for macsec hardware offload during NETDEV_UNREGISTER events because the underlay driver is not notified to release its offload resources; only software resources are freed.

Why it matters to the business

Systems using macsec with hardware offload may experience gradual resource exhaustion on network devices, leading to degraded network performance or instability after repeated interface events over the 849 days since disclosure.

How an attack unfolds

An attacker triggers repeated NETDEV_UNREGISTER events involving macsec devices configured for hardware offload; the missing notification to the underlay driver leaves offload resources allocated, resulting in a leak that can be abused to exhaust limited hardware resources.

How to fix it

Update the Linux kernel to a version containing the fix that moves offload handling from macsec_dellink() to macsec_common_dellink() for NETDEV_UNREGISTER; for the listed firefox packages on Ubuntu 20.04 LTS apply 124.0+build1-0ubuntu0.20.04.1 or later.

How to confirm the fix worked

Confirm the kernel source contains the macsec_common_dellink() call for offload cleanup on NETDEV_UNREGISTER; verify package versions match or exceed the stated fixed releases and test macsec offload teardown under interface removal.

Typical attack path

1. Identify systems with macsec hardware offload enabled
2. Cause or wait for NETDEV_UNREGISTER events on affected macsec netdevs
3. Observe accumulation of uncleared offload resources in the underlay driver
4. Repeat to exhaust hardware resources and impact availability

How to detect it

Review kernel logs and network driver traces for repeated macsec offload allocation without corresponding release on interface unregister events; correlate with threat actor mentions of Android kernel issues if similar patterns appear in mobile or embedded deployments.

What your security team should do

• Prioritize kernel updates on systems using macsec hardware offload given the 849-day exposure window
• Audit network configurations for macsec offload usage and disable where not required
• Monitor EPSS (stable at ~0.0023) and absence from KEV for deprioritization if patches cannot be applied immediately