CVE-2022-48735

What it actually does

Use-after-free vulnerability in ALSA hda codec LED handling where devm_led_classdev_register release ordering causes stale set_brightness_delay callbacks to be invoked after codec resource teardown, resulting in NULL dereference or UAF.

Why it matters to the business

Linux systems using HD-audio codecs with LED class devices may experience kernel crashes or potential local code execution during device unbind or module unload operations, leading to downtime and requiring urgent kernel updates.

How an attack unfolds

An attacker with local access triggers repeated binding/unbinding of the HD-audio codec device (via module reload, hotplug, or sysfs operations) to race the devres release against codec resource cleanup, invoking the stale callback for arbitrary read/write or denial of service.

How to fix it

Update the Linux kernel to a version containing commit a7de1002135cf94367748ffc695a29812d7633b5 or later that switches LED class device handling to manual registration/unregistration outside devres.

How to confirm the fix worked

Verify the running kernel contains the referenced commit or a backported equivalent; inspect dmesg or kernel logs for absence of prior NULL dereference or UAF warnings related to hda_gen_spec LED devices during codec unbind.

Typical attack path

1. Obtain local access on a Linux system with HD-audio and LED support
2. Load or trigger ALSA hda codec driver initialization
3. Perform repeated device unbind or module removal operations to race the release
4. Trigger use of the freed LED classdev callback to achieve UAF
5. Escalate to kernel code execution or cause system panic

How to detect it

Review kernel logs and dmesg for crashes or warnings mentioning hda_gen_spec, led_classdev, or set_brightness_delay during codec unbind or module unload events; correlate with audit logs showing repeated ALSA module load/unload activity.

What your security team should do

• Prioritize kernel upgrades on all affected Linux distributions within standard patch windows
• Restrict unprivileged local access where feasible until patched
• Monitor kernel logs for hda LED-related crashes as a temporary indicator