CVE-2022-48878

What it actually does

The shutdown callback in the Qualcomm Atheros Bluetooth HCI driver invokes serdev operations after the underlying TTY device has been closed or when the HCI device is not open, resulting in a use-after-free condition during kernel shutdown or reboot.

Why it matters to the business

Systems using affected Qualcomm Bluetooth hardware may experience kernel crashes or instability during reboot, potentially leading to operational disruption on shutdown. No widespread exploitation observed despite high ecosystem prevalence in Linux kernels.

How an attack unfolds

An attacker with local access or the ability to trigger system reboot could force the vulnerable shutdown path by causing hci_dev_open_sync to fail or powering off the device, leading to the use-after-free in tty_driver_flush_buffer called from qca_serdev_shutdown.

How to fix it

Update to Linux kernel versions containing commit e84ec6e25df9bb0968599e92eacedaf3a0a5b587. For Android, apply December 2022 updates to platform/packages/apps/PackageInstaller and platform/packages/modules/Permission.

How to confirm the fix worked

Verify kernel version includes the fix commit; test reboot on affected Qualcomm hardware and confirm absence of KASAN use-after-free reports involving tty_driver_flush_buffer and qca_serdev_shutdown.

Typical attack path

1. Obtain local access or ability to trigger reboot on affected Qualcomm Atheros Bluetooth hardware
2. Cause HCI device open failure or power-off condition
3. Initiate system reboot or shutdown
4. Trigger use-after-free in kernel during qca_serdev_shutdown

How to detect it

Check kernel logs for 'Unable to handle kernel paging request' or KASAN use-after-free reports involving tty_driver_flush_buffer, serdev_device_write_flush, and qca_serdev_shutdown during systemd-shutdown or reboot.

• qca_serdev_shutdown
• tty_driver_flush_buffer
• serdev_device_write_flush
• KASAN: use-after-free in tty_driver_flush_buffer
• Unable to handle kernel paging request at virtual address

What your security team should do

• Apply kernel updates immediately for affected Qualcomm devices
• Test reboot behavior on hardware with Qualcomm Atheros Bluetooth
• Monitor system logs for related oops or KASAN warnings during shutdown