CVE-2022-48851

What it actually does

Use-after-free in gdm_lte_rx() where netif_rx_ni() frees the skb and the code subsequently dereferences skb->len.

Why it matters to the business

Local attackers on affected Linux systems can trigger kernel crashes or escalate privileges, risking data exposure and service disruption on devices using the gdm724x driver.

How an attack unfolds

A local attacker crafts network traffic that reaches gdm_lte_rx(), causing netif_rx_ni() to free the skb; the subsequent dereference of the freed skb->len field leads to undefined behavior exploitable for code execution.

How to fix it

Upgrade the Linux kernel to the commit 6dc7b87c62423bfa68139fe95e85028aab584c9a or later stable releases containing the fix for gdm_lte_rx().

How to confirm the fix worked

Verify the running kernel contains commit 6dc7b87c62423bfa68139fe95e85028aab584c9a or confirm the gdm_lte_rx() function no longer dereferences skb after netif_rx_ni().

Typical attack path

1. Obtain local user access on a system running the vulnerable gdm724x driver
2. Send or trigger packets that invoke gdm_lte_rx()
3. Exploit the freed skb dereference to corrupt kernel memory or redirect execution
4. Escalate to root or execute arbitrary kernel code

How to detect it

Review kernel logs for oops/panic entries mentioning gdm_lte_rx or skb dereference after netif_rx_ni; inspect crash dumps for use-after-free patterns in the gdm724x module.

What your security team should do

• Apply the kernel patch containing commit 6dc7b87c immediately on all systems using the gdm724x staging driver
• Restrict local user access on affected hosts until patched
• Monitor for kernel oops or panic logs referencing gdm_lte_rx