CVE-2022-48864

What it actually does

Missing validation of the VIRTIO_NET_CTRL_MQ_VQ_PAIRS_SET command allows an untrusted driver to request an invalid number of queue pairs or issue the command when multiqueue was never negotiated, resulting in use of uninitialized queue resources and kernel panic.

Why it matters to the business

A local attacker can crash the host kernel, causing denial of service and loss of availability for any workloads running on the affected Linux system; the issue has been public for over two years with negligible exploit activity.

How an attack unfolds

An attacker with local access supplies a malicious VIRTIO_NET_CTRL_MQ_VQ_PAIRS_SET request through the control virtqueue; because the mlx5 nvdpa driver performs no bounds or negotiation checks, the request dereferences uninitialized queue structures and triggers a kernel panic.

How to fix it

Upgrade the Linux kernel to the commit e7e118416465f2ba8b55007e5b789823e101421e or later; apply the vendor-supplied package that contains this fix for the running distribution.

How to confirm the fix worked

Confirm the running kernel contains commit e7e118416465f2ba8b55007e5b789823e101421e; attempt to reproduce the panic with a test driver that issues an invalid VQ_PAIRS_SET command and verify the command is now rejected.

Typical attack path

1. Obtain local code execution or driver access on the target Linux host
2. Open or manipulate the virtio-net control virtqueue
3. Send a VIRTIO_NET_CTRL_MQ_VQ_PAIRS_SET command with an invalid queue-pair count or without prior multiqueue negotiation
4. Trigger kernel panic from uninitialized resources

How to detect it

Review kernel logs and crash dumps for panics originating in mlx5 or virtio-net queue initialization; look for unexpected VIRTIO_NET_CTRL_MQ_VQ_PAIRS_SET handling failures.

What your security team should do

• Patch affected kernels to the fixed commit at the earliest maintenance window
• Prioritize systems exposing virtio-net devices to untrusted guests or drivers
• Monitor kernel crash logs for virtio or mlx5 panic signatures until patching is complete