CVE-2022-48825

What it actually does

Missing initialization of stag_work for NPIV vports in the qedf driver leads to invalid delayed workqueue queuing during fc_lport_timeout handling in libfc, triggering kernel warnings and potential instability in the events workqueue.

Why it matters to the business

Enterprise Linux systems relying on qedf for Fibre Channel connectivity may only bring 32 of 64 NPIV ports online, causing partial storage access loss, degraded SAN performance, and operational disruptions. Widespread presence across Debian, Ubuntu, and mainline kernels amplifies exposure for storage-heavy workloads.

How an attack unfolds

An attacker triggers NPIV port creation or FC link events on affected systems; the uninitialized stag_work is then passed to queue_delayed_work_on from qedf_elsct_send, producing the workqueue warning and possible crash path in kernel/workqueue.c. No confirmed exploitation by listed threat actors or ransomware campaigns despite public disclosure.

How to fix it

Upgrade affected packages to the listed fixed versions: linux (Debian:11/12/13) to 5.10.103-1 or 5.16.7-1, mainline Kernel to 5.4.176, and all listed Ubuntu 20.04 LTS variants (linux-aws-5.15, linux-azure-5.15, etc.) to their corresponding 5.15.0- or 5.4.0- fixed builds. Reboot into the patched kernel after installation.

How to confirm the fix worked

Verify running kernel version matches or exceeds the fixed releases above; reproduce NPIV port creation and confirm absence of the workqueue.c:1635 warning and qedf call traces in dmesg or /var/log/kern.log.

Typical attack path

1. Identify or create conditions for NPIV vport instantiation on qedf-enabled hosts
2. Trigger fc_lport_enter_flogi or fc_lport_timeout paths via link events or timeouts
3. Execute qedf_elsct_send which attempts to queue uninitialized stag_work
4. Observe __queue_delayed_work warning and subsequent kworker instability

How to detect it

Search kernel logs and dmesg for the exact warning string from workqueue.c combined with qedf_elsct_send and fc_lport_timeout call traces; correlate with NPIV port creation events in system logs.

• WARNING: CPU:.*at kernel/workqueue.c:1635 __queue_delayed_work
• Workqueue: events fc_lport_timeout [libfc]
• qedf_elsct_send+0x57/0x60 [qedf]
• fc_lport_timeout+0xb7/0x140 [libfc]
• Tainted: G IOE

What your security team should do

• Apply kernel updates to all listed fixed versions immediately given 823 days since publication
• Monitor EPSS (stable at 0.00271) and absence from KEV for prioritization but do not delay patching on storage hosts
• Audit systems for qedf usage and test NPIV failover post-upgrade
• Update detection rules for the specific workqueue warning pattern