CVE-2022-48891

What it actually does

Race condition in da9211 regulator driver allows IRQ handler to execute before notifier structures are initialized, resulting in kernel read from unreadable memory during blocking_notifier_call_chain and regulator_notifier_call_chain.

Why it matters to the business

Systems using this regulator may crash on boot or during kexec-style restarts, causing unexpected downtime and requiring manual intervention to recover.

How an attack unfolds

An attacker with local access or the ability to trigger a kexec or non-reset boot sequence can leave a pending IRQ from the regulator; when the driver registers the handler before structures are ready the kernel dereferences invalid memory and panics.

How to fix it

Update to Linux kernel commit 1c1afcb8839b91c09d211ea304faa269763b1f91 or later; for affected Android platforms apply the SoCVersion 2021-10-05 fixes in qcacld-3.0 and qca-wifi-host-cmn.

How to confirm the fix worked

Confirm kernel version contains commit 1c1afcb8839b91c09d211ea304faa269763b1f91; verify da9211 driver initialization order prevents IRQ enablement before notifier structures; test kexec boot paths for absence of the described panic.

Typical attack path

1. Obtain ability to trigger kexec or reboot without full hardware reset
2. Ensure regulator has a pending IRQ from prior state
3. Load da9211 driver which enables IRQ handler prematurely
4. Trigger IRQ to execute uninitialized notifier chain
5. Cause kernel panic via invalid memory access

How to detect it

Search kernel logs for the exact panic strings 'Unable to handle kernel read from unreadable memory at virtual address 0000000000000078' and 'da9211_irq_handler' around boot or kexec events; inspect dmesg and syslog for regulator_notifier_call_chain call traces.

• da9211_irq_handler+0x68/0xf8
• regulator_notifier_call_chain+0x1c/0x2c
• blocking_notifier_call_chain+0x20/0xa8
• Unable to handle kernel read from unreadable memory at virtual address 0000000000000078

What your security team should do

• Prioritize patching kernel images used in environments that perform kexec or rapid restarts
• Audit bootloader and initramfs configurations to ensure full hardware reset where possible
• Monitor for kernel oops involving da9211_irq_handler and blocking_notifier_call_chain
• Apply vendor SoCVersion updates for Android devices using the affected Qualcomm WLAN components