CVE-2022-48857

What it actually does

Missing usb_kill_urb calls on error paths in port100_probe allow port100_send_complete to access devm-allocated memory after it has been freed on probe failure, resulting in a use-after-free.

Why it matters to the business

Linux systems with affected NFC hardware may experience kernel panics or instability during device initialization errors, increasing downtime and requiring urgent patching on servers, embedded devices, and Android kernels.

How an attack unfolds

An attacker supplies a USB NFC device that triggers an error during port100_probe; without URB cancellation the subsequent urb completion callback dereferences already-freed memory, leading to a crash or potential memory corruption.

How to fix it

Apply the upstream fix by updating to a kernel containing commit 205c4ec78e71cbf561794e6043da80e7bae6790f; rebuild and reboot with the patched kernel. For distributions, install the corresponding security update that backports this change.

How to confirm the fix worked

Verify the running kernel contains commit 205c4ec78e71cbf561794e6043da80e7bae6790f or a later equivalent; confirm absence of the UAF by reproducing the original probe-error scenario under KASAN or by inspecting the port100.c source for usb_kill_urb calls before error returns.

Typical attack path

1. Attach or enumerate a port100-compatible NFC USB device
2. Force an error condition inside port100_probe before URBs are initialized
3. Allow the probe to fail and release devres nodes
4. Trigger urb completion via usb_hcd_giveback_urb on the still-scheduled URB
5. Access freed memory inside port100_send_complete

How to detect it

Search kernel logs for KASAN use-after-free reports referencing port100_send_complete or drivers/nfc/port100.c; inspect dmesg and crash dumps for urb giveback traces originating from the port100 driver during probe failure sequences.

• port100_send_complete+0x16e/0x1a0
• drivers/nfc/port100.c:935
• BUG: KASAN: use-after-free in port100_send_complete

What your security team should do

• Prioritize kernel updates on all systems exposing NFC hardware or running Android kernels
• Monitor vendor advisories for backported fixes in LTS branches
• Add the fixed commit hash to internal patch-review checklists
• Test NFC device hot-plug and error paths in staging environments before broad rollout