CVE-2022-48794

What it actually does

The vulnerability causes a memory leak of socket buffer (skb) structures in the ieee802154 at86rf230 driver when transmission errors occur, because the skb is not freed on error paths before returning.

Why it matters to the business

Over time, repeated triggering of error conditions can lead to memory exhaustion, potentially causing system instability or denial of service on devices using this wireless hardware, especially in embedded or IoT environments with high prevalence in Linux-based systems.

How an attack unfolds

An attacker with the ability to interact with the at86rf230 radio hardware or induce transmission errors (such as through radio interference or state manipulation) can trigger the leak repeatedly to exhaust kernel memory; unrelated references to Android kernel RCE do not apply here.

How to fix it

Update the Linux kernel to a version containing commit d2a1eaf51b7d4412319adb6acef114ba472d1692 which properly frees the skb on error paths using an intermediate was_tx boolean.

How to confirm the fix worked

Verify the kernel source tree includes the referenced fix commit or inspect the at86rf230 driver error handling for correct skb freeing before return.

Typical attack path

1. Identify systems running vulnerable Linux kernels with at86rf230 802.15.4 support
2. Induce transmission errors via radio conditions or stack manipulation
3. Repeat error conditions to accumulate unfreed skb structures
4. Monitor for kernel memory depletion leading to instability

How to detect it

Review kernel logs for ieee802154 or at86rf230 error paths and correlate with unexplained memory growth; no active exploitation indicators given low EPSS and non-KEV status.

What your security team should do

• Apply kernel updates containing the fix commit on all affected systems
• Monitor memory consumption in wireless subsystems for anomalous growth
• Restrict physical or logical access to 802.15.4 interfaces where feasible