CVE-2022-48868

What it actually does

Improper error handling in drv_enable_wq() allows the idxd DMA engine driver to load successfully even when workqueue enabling fails (e.g., idxd_wq_request_irq or idxd_wq_init_percpu_ref errors), leaving the driver in an inconsistent state that triggers WARN, BUG, or NULL pointer dereference during subsequent driver remove paths.

Why it matters to the business

Kernel instability or crashes on systems using the idxd driver can lead to unexpected reboots, service outages, and data loss risks, with higher urgency for organizations running affected stable kernels that have not yet applied the fix.

How an attack unfolds

An attacker with local access triggers a failure condition during idxd_dmaengine_drv_probe (such as IRQ request failure) so that drv_enable_wq incorrectly returns success; later, driver removal via idxd_dmaengine_drv_remove executes cleanup paths on uninitialized or already-freed resources, resulting in kernel panics.

How to fix it

Update the Linux kernel to a version containing commit 0f150134dd795ffcd60b798a85ab737d8d010fb7 or later; ensure the idxd driver is rebuilt and loaded from the patched source.

How to confirm the fix worked

Confirm the running kernel contains commit 0f150134dd795ffcd60b798a85ab737d8d010fb7; attempt to reproduce the original failure paths during probe and verify that probe now fails cleanly without loading the driver; monitor for absence of the described BUG/WARN on unload.

Typical attack path

1. Obtain local code execution or module loading privileges on a Linux system using the idxd driver
2. Force a probe-time failure in workqueue enabling (e.g., via resource contention or fault injection)
3. Allow the driver to load despite the error
4. Trigger driver unload or module removal to execute the flawed cleanup paths
5. Cause kernel NULL dereference, BUG, or warning that leads to panic or denial of service

How to detect it

Search kernel logs and dmesg for messages containing idxd_wq_request_irq failures followed by drv_enable_wq returning 0, or subsequent BUG/kernel NULL pointer dereference and percpu_ref_kill traces during module unload; inspect crash dumps for the idxd driver in the call stack.

What your security team should do

• Prioritize kernel upgrades on all systems exposing the idxd driver
• Test the updated kernel in staging environments that exercise driver load/unload cycles
• Review kernel logs for any prior occurrences of idxd-related NULL dereference or percpu_ref BUGs
• Apply the fix before the next scheduled maintenance window given the 787 days since publication