CVE-2022-48780

What it actually does

In the Linux kernel net/smc subsystem, fallback handling saves and replaces clcsock callback functions but fails to guard against repeated fallbacks, causing the saved copies to be overwritten and resulting in an infinite loop between smc_fback_error_report, smc_fback_forward_wakeup, and the incorrectly restored clcsock callbacks.

Why it matters to the business

Systems using SMC networking may experience hangs, excessive CPU usage, or crashes under repeated fallback conditions, potentially disrupting network-dependent services and requiring restarts.

How an attack unfolds

An attacker establishes SMC connections and forces repeated fallback paths (for example through connection resets or errors) to trigger the callback overwrite; once the loop forms, the kernel enters the recursive error-report cycle without further attacker interaction.

How to fix it

Upgrade the Linux kernel to a version containing commit 279a472015ec675c1da449d902dc82e4dd578484 or later; apply the one-time-save logic for clcsock callbacks during fallback.

How to confirm the fix worked

Confirm the patch is present by checking kernel source or git history for the one-time callback save guard; test by exercising multiple SMC fallbacks and verifying absence of the recursive call loop.

Typical attack path

1. Initiate SMC connection to target
2. Trigger conditions that cause fallback more than once
3. Observe or force error_report path to enter the overwritten callback loop

How to detect it

Search kernel logs and stack traces for repeated smc_fback_error_report or smc_fback_forward_wakeup entries; look for SMC connection teardown patterns coinciding with high CPU or hung tasks.

What your security team should do

• Prioritize kernel updates on systems using SMC (especially those with fallback-prone workloads)
• Monitor for SMC-related stability issues until patched
• Review network configuration to reduce unnecessary SMC fallback triggers where possible