CVE-2022-48863

What it actually does

The vulnerability is a memory leak in dsp_pipeline_build() where kstrdup allocates memory for dup, strsep advances the pointer past the first token, and kfree is then invoked on the now-NULL pointer, permanently losing the original allocation.

Why it matters to the business

On systems using mISDN hardware, repeated invocation can exhaust kernel memory, degrading performance or causing denial of service; the issue affects a wide range of Linux kernel deployments but carries no ransomware association and no active exploitation campaigns.

How an attack unfolds

A local attacker supplies a configuration string containing pipe characters to dsp_pipeline_build, causing the pointer update that orphans the allocation; the leak occurs on every call without requiring special privileges beyond local access.

How to fix it

Upgrade the Linux kernel to a version containing commit a3d5fcc6cf2ecbba5a269631092570aa285a24cb or later; rebuild and reboot with the patched kernel; apply vendor backports if a distribution kernel is in use.

How to confirm the fix worked

Confirm the running kernel source contains the fix commit a3d5fcc6cf2ecbba5a269631092570aa285a24cb; inspect dsp_pipeline_build for kstrdup followed by strsep without an intermediate pointer copy before kfree; monitor kernel memory statistics under load exercising mISDN.

Typical attack path

1. Obtain local user access on an affected Linux system
2. Trigger dsp_pipeline_build via mISDN DSP configuration containing '|' delimiters
3. Repeat the operation to accumulate leaked memory
4. Observe gradual kernel memory exhaustion leading to performance degradation or OOM conditions

How to detect it

Review kernel logs and memory accounting for unexplained growth in slab allocations tied to mISDN DSP objects; correlate with processes invoking ISDN configuration ioctls; no public indicators of active exploitation exist for this issue.

What your security team should do

• Prioritize kernel upgrade on any system exposing mISDN interfaces
• Apply the fixed commit a3d5fcc6cf2ecbba5a269631092570aa285a24cb within standard patch windows
• Restrict local access to mISDN-capable devices until patched
• Monitor memory usage trends on unpatched hosts as a temporary compensating control