CVE-2022-48883

What it actually does

Missing validation allows creation of child PKEY interfaces specifying fewer rx queues than the parent, causing the parent's rx channel index to access beyond the bounds of the child's smaller channel_stats array.

Why it matters to the business

Systems using MLX5 IPoIB interfaces can experience crashes, memory corruption, or kernel-level compromise when unprivileged users create misconfigured child interfaces, increasing downtime and exposure risk on affected Linux deployments.

How an attack unfolds

An attacker with local netlink privileges crafts a request to create a child PKEY interface declaring a smaller rx queue count than the parent; the kernel then uses the parent's larger channel index to write or read the undersized child statistics array, triggering an out-of-bounds access that can be turned into memory corruption or denial of service.

How to fix it

Upgrade the Linux kernel to commit 5844a46f09f768da866d6b0ffbf1a9073266bf24 or later; Android devices should apply the corresponding 2021-08-01 patches for frameworks/av and libavc in versions 8.1, 9, 10, and 11.

How to confirm the fix worked

Confirm the running kernel contains commit 5844a46f09f768da866d6b0ffbf1a9073266bf24; attempt to create a PKEY child interface with rx queue count lower than the parent and verify the operation is rejected with an error.

Typical attack path

1. Obtain local access or netlink privileges on a system with MLX5 IPoIB enabled
2. Use netlink to request creation of a PKEY child interface specifying fewer rx queues than the parent
3. Trigger receive channel activity that indexes the undersized channel_stats array
4. Exploit the resulting out-of-bounds read/write for privilege escalation or denial of service

How to detect it

Review kernel logs for messages related to PKEY interface creation failures or out-of-bounds accesses in mlx5e; inspect netlink audit logs for child interface creation attempts with mismatched rx queue counts.

What your security team should do

• Apply the kernel and Android patches immediately on all MLX5 IPoIB systems
• Restrict netlink interface creation privileges to trusted users until patches are deployed
• Monitor for any remaining unpatched systems given the 787-day publication window