CVE-2022-48789

What it actually does

Race condition in nvme-tcp error recovery allows async_event_work to run after the admin queue has been torn down, resulting in a use-after-free of queue and controller structures.

Why it matters to the business

Local attackers with access to an NVMe-over-TCP device can trigger a kernel crash or potential code execution, leading to system downtime, data corruption, or full host compromise on affected Linux systems.

How an attack unfolds

An attacker with local access triggers an NVMe-TCP transport error that schedules error_recovery work. The race allows submit_async_event to still execute after the controller state is set to RESETTING and the queue is destroyed, dereferencing freed memory during command preparation or I/O scheduling.

How to fix it

Update the Linux kernel to a version containing commit 61a26ffd5ad3ece456d74c4c79f7b5e3f440a141 or later. Rebuild and reboot all affected hosts; apply vendor backports if running distribution kernels.

How to confirm the fix worked

Verify the running kernel contains commit 61a26ffd5ad3ece456d74c4c79f7b5e3f440a141 or an equivalent backport; inspect dmesg for absence of the prior race condition and confirm nvme-tcp module loads without triggering error recovery paths.

Typical attack path

1. Obtain local access on a system using nvme-tcp transport
2. Trigger a transport-level error condition that activates error recovery
3. Race the async event submission against queue destruction
4. Trigger use-after-free during command preparation or work scheduling
5. Achieve kernel crash, memory corruption, or code execution

How to detect it

Review kernel logs for oops, panic, or workqueue warnings referencing nvme_tcp_submit_async_event_work or error_recovery; correlate with NVMe-TCP device errors or queue teardown events.

What your security team should do

• Prioritize kernel updates on all systems exposing NVMe-TCP devices
• Restrict local access to hosts using nvme-tcp until patched
• Monitor for kernel oops or crashes involving nvme_tcp error recovery
• Test updated kernels in staging environments before broad deployment