CVE-2022-48751

What it actually does

Race condition allows use-after-free of the clcsock pointer in smc_setsockopt, smc_getsockopt and smc_switch_to_fallback, resulting in kernel NULL pointer dereference.

Why it matters to the business

Local denial-of-service that can crash the kernel on systems using SMC sockets, disrupting services and requiring reboots; high prevalence in Linux distributions increases exposure.

How an attack unfolds

An attacker with local code execution triggers concurrent socket option calls while the underlying clcsock is being released, causing the kernel to dereference a freed pointer and panic.

How to fix it

Upgrade the Linux kernel to a version containing commit 8fe28cb58bcb235034b64cbbb7550a8a43fd88be or later; apply the stable backports that add the clcsock_release_lock checks.

How to confirm the fix worked

Confirm the running kernel contains commit 8fe28cb58bcb235034b64cbbb7550a8a43fd88be; verify smc_setsockopt, smc_getsockopt and smc_switch_to_fallback contain the lock-and-check pattern before accessing clcsock.

Typical attack path

1. Obtain local execution on a Linux system with SMC enabled
2. Create or inherit an SMC socket
3. Race smc_setsockopt or smc_getsockopt against clcsock release
4. Trigger NULL dereference and kernel oops

How to detect it

Inspect kernel logs for oops messages containing smc_setsockopt, smc_getsockopt or smc_switch_to_fallback and a NULL pointer dereference at address 0x20; correlate with processes calling setsockopt on SMC sockets.

• BUG: kernel NULL pointer dereference, address: 0000000000000020
• RIP: smc_setsockopt+0x59/0x280 [smc]
• Call Trace: __sys_setsockopt

What your security team should do

• Prioritize kernel updates on all systems that may use SMC sockets
• Monitor for kernel oops involving smc_setsockopt
• Disable SMC (smc module) where not required until patched