CVE-2022-48803

What it actually does

Missing sentinel entry in clk_div_table array in phy-j721e-wiz.c allows _get_table_maxdiv() to perform out-of-bounds read during divider rate calculations in the clock framework.

Why it matters to the business

Kernel crashes or boot failures on systems using affected TI J721e PCIe PHY hardware can interrupt services, delay deployments, and require emergency patching across Linux server fleets.

How an attack unfolds

During kernel initialization or deferred probe of the cdns_pcie driver on TI J721e hardware, clk_set_rate triggers divider_round_rate_parent which calls into the vulnerable _get_maxdiv function, reading past the end of the clk_div_table array and triggering a KASAN-detected global-out-of-bounds access.

How to fix it

Upgrade to patched kernel packages: Debian 11/12/13 use 5.10.103-1 or 5.16.7-1; Ubuntu 20.04/22.04 use the listed 5.15.0-*-* or 5.4.0-1020.24 updates for each flavor (linux-aws-5.15, linux-azure-5.15, linux-gcp-5.15, linux-hwe-5.15, linux-ibm-5.15, linux-intel-iotg-5.15, linux-lowlatency-hwe-5.15, linux-oracle-5.15, linux-riscv-5.15, linux-xilinx-zynqmp). Reboot after installation.

How to confirm the fix worked

Verify running kernel version matches or exceeds the fixed package for the distribution; confirm presence of sentinel entry in clk_div_table via source inspection or successful boot without KASAN reports on J721e hardware.

Typical attack path

1. Boot or hotplug hardware matching the J721e PCIe controller
2. Kernel loads phy-j721e-wiz driver and schedules deferred_probe_work_func
3. cdns_sierra_phy_init calls clk_set_rate on the affected divider clock
4. divider_determine_rate walks the unsentinaled clk_div_table causing out-of-bounds read
5. Kernel hits BUG or panic depending on KASAN and panic_on_oops settings

How to detect it

Search kernel logs and dmesg for KASAN global-out-of-bounds reports referencing _get_maxdiv, divider_determine_rate, clk_div_table, or cdns_sierra_phy_init; inspect crash dumps for the exact address ffff8000095b25a4 and the clk_div_table variable offset.

• BUG: KASAN: global-out-of-bounds in _get_maxdiv
• clk_div_table+0x24/0x440
• Read of size 4 at addr ffff8000095b25a4
• _get_maxdiv+0xc0/0x148
• wiz_clk_div_round_rate+0x54/0x68
• cdns_sierra_phy_init+0x88/0x248

What your security team should do

• Immediately patch all systems running the listed vulnerable Ubuntu and Debian kernel packages
• Prioritize hosts with Texas Instruments J721e or cdns-pcie hardware
• Monitor kernel logs for KASAN or divider clock errors during boot
• Test patched kernels in staging environments before broad rollout