CVE-2022-48887

What it actually does

The flaw is a race condition in the vmwgfx driver's user resource lookups that used buggy RCU paths, allowing concurrent modifications from multiple threads submitting command buffers and resulting in kernel oopses and crashes.

Why it matters to the business

Linux systems using VMware graphics may experience repeated kernel crashes and instability, disrupting workloads, causing downtime, and requiring restarts or patches across many deployments.

How an attack unfolds

An attacker submits graphics command buffers concurrently from multiple threads to trigger the flawed RCU-based resource lookups in vmwgfx, leading to inconsistent shared state and kernel crashes.

How to fix it

Update the Linux kernel to a version containing commit 7ac9578e45b20e3f3c0c8eb71f5417a499a7226a which replaces the RCU paths with a regular spin lock.

How to confirm the fix worked

Confirm the running kernel includes the referenced commit, then run stress tests such as IGT vmwgfx execution_buffer to verify absence of crashes under concurrent load.

Typical attack path

1. Gain ability to submit command buffers on a system using the vmwgfx driver
2. Issue concurrent submissions from separate threads targeting shared user resources
3. Trigger the race in RCU lookup paths to cause kernel oops and crash

How to detect it

Inspect kernel logs and dmesg for oops or panic messages referencing vmwgfx, user resources, or command buffer submissions under concurrent access.

What your security team should do

• Apply the kernel fix containing commit 7ac9578e45b20e3f3c0c8eb71f5417a499a7226a as soon as possible on all affected systems
• Monitor kernel logs for oopses mentioning vmwgfx resource handling
• Limit untrusted access to graphics command submission interfaces where feasible