CVE-2022-48745

What it actually does

The flaw substitutes del_timer() with del_timer_sync() in the mlx5 firmware reset polling deactivation path to eliminate a race where a timer is deactivated while its handler is executing, preventing concurrent access that manifests as a crash in run_timer_softirq.

Why it matters to the business

Systems using affected Linux kernel versions with mlx5 network hardware may experience unexpected crashes or instability during firmware reset operations, leading to downtime and requiring reboots.

How an attack unfolds

An attacker with the ability to trigger firmware reset conditions on mlx5 devices can induce the race window between del_timer() and an active timer interrupt, resulting in a kernel softirq crash; no remote unauthenticated exploitation path is known.

How to fix it

Update the Linux kernel to a version containing commit 502c37b033fab7cde3e95a570af4f073306be45e or later; apply the patch that replaces del_timer() with del_timer_sync() in the fw reset polling deactivation code.

How to confirm the fix worked

Verify the running kernel source contains the del_timer_sync change in drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c; confirm no crash traces referencing run_timer_softirq during mlx5 reset operations after upgrade.

Typical attack path

1. Obtain local or privileged access to trigger mlx5 firmware reset flow
2. Time the reset with an active timer interrupt handler
3. Exploit the window between del_timer() and handler execution to cause use-after-free or crash in timer softirq

How to detect it

Search kernel logs and crash dumps for call traces involving run_timer_softirq, recalibrate_cpu_khz, and mlx5 fw reset paths; correlate with mlx5 device reset events in dmesg or journalctl.

What your security team should do

• Prioritize kernel upgrade on systems with mlx5 hardware within standard patch windows
• Monitor for kernel oops or panic logs containing run_timer_softirq and recalibrate_cpu_khz
• Test firmware reset paths in staging environments before production rollout