CVE-2022-48726

What it actually does

Use-after-free in ucma_cleanup_multicast when xa_for_each() on the multicast xarray touches a concurrently freed mc struct because allocation/erasure of multicast structs is not serialized.

Why it matters to the business

Kernel memory corruption on Linux systems using RDMA/ucma can cause crashes, data corruption, or local privilege escalation, disrupting high-performance networking, storage clusters, and any workloads relying on InfiniBand or RoCE.

How an attack unfolds

An attacker with local access opens the ucma device and issues concurrent multicast join and leave operations; the unlocked xarray walk in ucma_destroy_private_ctx dereferences a freed multicast structure, enabling KASAN-detectable use-after-free that can be turned into arbitrary read/write or code execution.

How to fix it

Upgrade the Linux kernel to a version containing commit 75c610212b9f1756b9384911d3a2c347eee8031c or later; rebuild and reboot all affected nodes; disable RDMA/ucma if the feature is not required.

How to confirm the fix worked

Verify the running kernel contains commit 75c610212b9f1756b9384911d3a2c347eee8031c; recompile with KASAN and confirm the syzkaller reproducer no longer triggers use-after-free reports; scan package manifests for the fixed git hash across the fleet.

Typical attack path

1. Obtain local unprivileged access on a Linux host with RDMA/ucma enabled
2. Open /dev/infiniband/rdma_ucm and allocate a private context
3. Trigger overlapping ucma_multicast_join and ucma_multicast_leave calls from multiple threads
4. Force context destruction via ucma_destroy_id while the xarray scan is in progress
5. Leverage the resulting use-after-free for kernel memory corruption or RCE

How to detect it

Review kernel logs (dmesg, journalctl) for KASAN use-after-free reports mentioning ucma_cleanup_multicast or ucma_destroy_private_ctx; correlate with process creation of RDMA-related binaries or unusual ucma device opens; examine crash dumps for references to the affected commit range.

• KASAN: use-after-free in ucma_cleanup_multicast
• ucma_destroy_private_ctx+0x914/0xb70
• BUG: KASAN: use-after-free in ucma_destroy_private_ctx

What your security team should do

• Immediately schedule kernel updates to the fixed commit on all production RDMA hosts
• Prioritize patching systems that expose ucma to untrusted local users or containers
• Add kernel version checks to vulnerability scanning and CI pipelines
• Consider disabling RDMA interfaces on systems where they are not explicitly needed