CVE-2022-48755

What it actually does

On 64-bit PowerPC systems using processors predating ISA v2.06, the BPF JIT compiler emits the ldbrx instruction for endianness conversion operations (BPF_FROM_LE/BE), which is unsupported and triggers an illegal instruction exception during JITed program execution.

Why it matters to the business

Affected PowerPC-based systems may experience kernel crashes when loading or running BPF programs that perform byte-order swaps, disrupting networking, observability, and security tooling that depends on eBPF.

How an attack unfolds

An attacker loads a BPF program containing ALU endianness conversion operations onto an older PowerPC system; the JIT emits ldbrx, the processor faults with an illegal instruction, and the kernel oops terminates the context, potentially leading to denial of service or instability.

How to fix it

Upgrade the Linux kernel to a version containing commit 129c71829d7f46423d95c19e8d87ce956d4c6e1c or later that guards ldbrx emission and provides a fallback path for older PowerPC processors.

How to confirm the fix worked

Confirm the running kernel contains the referenced commit, verify that BPF programs using endian conversions no longer produce illegal instructions on e5500-class hardware, and re-run relevant test_bpf cases without crashes.

Typical attack path

1. Identify a target running Linux on pre-ISA v2.06 PowerPC hardware
2. Craft or reuse a BPF program that exercises BPF_FROM_LE or BPF_FROM_BE operations
3. Load the program via bpf() syscall or a module such as test_bpf
4. Trigger JIT compilation and execution of the program
5. Observe illegal instruction exception and kernel crash

How to detect it

Search kernel logs for Oops entries containing illegal instruction, NIP values near BPF JIT code, or references to test_bpf and ldbrx on PowerPC systems; inspect dmesg or syslog for BE PAGE_SIZE traces and module load events around the time of crashes.

What your security team should do

• Prioritize kernel upgrades on all PowerPC systems older than ISA v2.06
• Restrict unprivileged BPF loading until patches are applied
• Monitor for kernel oops entries referencing ldbrx or test_bpf during BPF program loads