CVE-2022-48858

What it actually does

Race condition in mlx5 command flush allows one process to free a command entry while another holds a stale reference, triggering use-after-free on refcount operations during error state handling.

Why it matters to the business

Systems using affected Mellanox network adapters may experience kernel instability, crashes, or potential local privilege escalation, leading to downtime and requiring urgent kernel updates across fleets with high device prevalence.

How an attack unfolds

An attacker with local access triggers command submissions that race against the flush path in mlx5_cmd_trigger_completions, causing the refcount use-after-free; the provided threat actor context does not align with this local kernel flaw.

How to fix it

Upgrade Linux kernel to version 5.4.185 or later, or apply commit 1a4017926eeea56c7540cc41b42106746ee8a0ee in the stable tree; rebuild and reboot with the patched kernel.

How to confirm the fix worked

Confirm kernel version is at or above the fixed releases; run targeted mlx5 command workloads under error injection and verify absence of refcount warnings in dmesg.

Typical attack path

1. Obtain local access on a system with mlx5 hardware
2. Issue concurrent mlx5 commands while forcing error state entry
3. Trigger mlx5_cmd_flush from enter_error_state worker
4. Exploit resulting use-after-free for memory corruption or crash

How to detect it

Search kernel logs for refcount_t warnings originating from mlx5_cmd_trigger_completions or mlx5_cmd_flush call stacks during error state transitions.

What your security team should do

• Prioritize kernel upgrades on all systems exposing mlx5 devices within the next patching cycle
• Monitor EPSS and KEV status for any future changes indicating increased risk
• Restrict local unprivileged access where mlx5 hardware is present until patched