CVE-2022-48867

What it actually does

Use-after-free on descriptor completion memory during driver unload in the idxd dmaengine, where descriptors are freed before possible device completion writes, resulting in a kernel page fault on access to freed memory.

Why it matters to the business

Systems using the idxd driver may experience kernel crashes or instability when the driver is unloaded, potentially disrupting DMA operations and requiring reboots; low exploitability reduces immediate risk but affects kernel stability on affected Linux distributions.

How an attack unfolds

An attacker with local access triggers repeated load/unload cycles of the idxd driver while pending descriptors exist, causing the use-after-free during idxd_flush_pending_descs after resources are freed via idxd_wq_free_resources.

How to fix it

Update the Linux kernel to a version containing commit b9e8e3fcfec625fc1c2f68f684448aeeb882625b or later; ensure idxd descriptors are freed only after idxd_wq_reset completes.

How to confirm the fix worked

Confirm the kernel source includes the fix commit; test by loading/unloading the driver under descriptor load and verify absence of page fault oops in dmesg; check kernel version against distribution updates.

Typical attack path

1. Obtain local code execution or shell access on a Linux system using the idxd driver
2. Trigger conditions with pending DMA descriptors
3. Unload the driver module to invoke the vulnerable flush path
4. Observe kernel page fault and potential crash or memory corruption

How to detect it

Search kernel logs for 'BUG: unable to handle page fault for address' combined with 'idxd' or 'dmaengine' module references around driver unload events; inspect for 'not-present page' faults during idxd_wq_free_irq flows.

• BUG: unable to handle page fault for address:.*idxd
• idxd_dmaengine_drv_remove
• idxd_flush_pending_descs
• drv_disable_wq

What your security team should do

• Prioritize kernel updates on systems exposing the idxd driver
• Monitor for kernel oops logs related to idxd page faults
• Apply updates within standard patch cycles given low EPSS and no KEV status