CVE-2022-48797

What it actually does

The kernel's change_pte_range() incorrectly used page_mapcount() instead of page_count() when deciding whether to apply NUMA faults to COW pages, allowing NUMA balancing to attempt migration of pages that remain referenced by GUP pins or swapped-out mappings and thereby triggering spurious write faults and memory corruption.

Why it matters to the business

Workloads that rely on NUMA balancing together with user-space accelerators or DMA pinning (common in AI/ML and high-performance computing) can silently corrupt data or crash, forcing operators to disable NUMA balancing or pin processes to single nodes and reducing overall system performance and reliability.

How an attack unfolds

An attacker or misbehaving workload enables kernel NUMA balancing, maps memory that is later pinned via GUP for DMA, and triggers the faulty COW path; the incorrect mapcount check causes the kernel to clear write permission on a still-referenced page, resulting in an unintended copy and subsequent corruption visible to the accelerator or other users of the page.

How to fix it

Upgrade the Linux kernel to a version containing commit 254090925e16abd914c87b4ad1b489440d89c4c3 (or the equivalent backport in the stable tree). Reboot and verify the new kernel is running. If an immediate update is impossible, disable NUMA balancing with 'echo 0 > /proc/sys/kernel/numa_balancing' or bind critical processes to specific NUMA nodes.

How to confirm the fix worked

Confirm the running kernel contains the fix commit, then reproduce the original test workload that exercises GUP pinning with NUMA balancing enabled and verify absence of corruption. Check dmesg and application logs for any remaining NUMA-related faults on pinned pages.

Typical attack path

1. Enable NUMA balancing on a multi-node system
2. Run a process that maps writable pages and pins them with GUP for DMA or accelerator use
3. Avoid binding the process to a single NUMA node
4. Trigger page faults or NUMA scanning so change_pte_range() evaluates the pinned COW page
5. Observe memory corruption or application failure

How to detect it

Review kernel logs for unexpected COW faults or NUMA migration messages on pages that are also referenced by GUP or DMA operations; correlate with application-level corruption reports and check whether NUMA balancing was active at the time of the incident.

What your security team should do

• Prioritize kernel updates on all multi-node systems that run NUMA balancing and accelerator/DMA workloads
• Temporarily disable NUMA balancing where the fix cannot be applied quickly
• Add kernel version checks to deployment pipelines and asset inventories
• Monitor for future stable-kernel updates that reference this commit