CVE-2022-48777

What it actually does

NULL pointer dereference in the Qualcomm MTD partition parser cleanup path when an empty partition name is encountered, causing an incorrect partition count to be returned and a subsequent kernel panic.

Why it matters to the business

Unexpected system crashes during boot or flash device initialization on affected Linux kernels can cause downtime and loss of availability, particularly on embedded and mobile devices; the large number of downstream package variants increases patching scope.

How an attack unfolds

An attacker supplies a specially crafted Qualcomm partition table containing one or more entries with empty names; the parser incorrectly counts the partitions and later dereferences a NULL name pointer during cleanup, triggering a kernel panic.

How to fix it

Upgrade to a fixed kernel package version for each distribution: Debian 12/13 to 5.15.15-1 or newer; Ubuntu 20.04 LTS and derivative packages (linux-aws, linux-azure, linux-gcp, etc.) to the corresponding 5.4.0- or 5.15.0- revisions listed in the fixed_versions field.

How to confirm the fix worked

Verify the running kernel version matches or exceeds the fixed package version for the distribution; confirm the vulnerable qcom parser code path has been removed by inspecting /proc/version or the package changelog.

Typical attack path

1. Obtain or craft a flash image whose Qualcomm SMEM partition table contains empty-name entries
2. Present the image to the kernel so the qcom MTD parser is invoked
3. Trigger partition parsing (boot, module load, or hotplug)
4. Observe NULL dereference and kernel panic in the cleanup routine

How to detect it

Search kernel logs and crash dumps for oops/panic messages containing "mtd: parsers: qcom" or NULL pointer dereference during partition table parsing; correlate with boot-time flash device initialization events.

• mtd: parsers: qcom
• qcomsmem
• NULL pointer dereference.*parse_qcom

What your security team should do

• Apply the listed fixed kernel packages immediately on all Debian 12/13 and Ubuntu 20.04 systems
• Prioritize reboot of devices that mount Qualcomm-based flash storage
• Monitor EPSS and threat-intel feeds for any future increase in exploit maturity