CVE-2022-48784

What it actually does

Race condition in cfg80211 netlink owner interface destruction where concurrent execution of cfg80211_destroy_ifaces and nl80211_netlink_notify can lead to attempting destruction of an unclosed interface, reintroducing the original deadlock.

Why it matters to the business

Potential system instability or hangs in Linux wireless networking stacks used by dependent applications, increasing downtime risk for affected services with moderate prevalence in downstream projects.

How an attack unfolds

An attacker with local access or control over netlink operations triggers the race by managing multiple wdev/netdev interfaces while netlink notifications mark owners dead, exploiting the dual-loop logic in interface destruction; threat actor context includes Android kernel exploitation attempts that may leverage similar wireless stack races for remote code execution.

How to fix it

Update affected packages to fixed versions including mudler/localai (GIT) commit 1a3dedece06cab1acc3332055d285ac540a47f0e; apply upstream Linux kernel patches resolving the single-iteration destruction logic.

How to confirm the fix worked

Verify presence of the single-iteration fix in cfg80211_destroy_ifaces and confirm no dual-loop behavior remains; test with concurrent interface creation/destruction under netlink load.

Typical attack path

1. Establish multiple wireless interfaces via cfg80211
2. Initiate concurrent netlink notifications to mark owners dead
3. Trigger cfg80211_destroy_ifaces during the marking window
4. Cause second iteration to encounter unclosed interface leading to deadlock

How to detect it

Search kernel logs and netlink traces for repeated interface close/destroy sequences or deadlock indicators around cfg80211 operations; incorporate threat actor patterns from Android kernel RCE attempts involving wireless stacks.

What your security team should do

• Prioritize patching Linux kernel and dependent packages like localai to the listed fixed commit due to 823 days since publication
• Monitor wireless interface management logs for anomalies
• Review EPSS stability and absence from KEV for risk prioritization