CVE-2022-48894

What it actually does

The arm-smmu-v3 driver invokes iommu_device_unregister during device shutdown without coordinating with IOMMU group users, resulting in NULL pointer dereferences during subsequent DMA API calls in dependent drivers.

Why it matters to the business

Systems running affected kernels may experience crashes or instability during shutdown or reboot, disrupting maintenance windows, increasing downtime risk, and potentially causing data corruption in high-availability Linux environments.

How an attack unfolds

An attacker with the ability to initiate a controlled shutdown or reboot on a vulnerable system can trigger the uncoordinated IOMMU unregistration, leading to NULL dereferences in DMA paths used by other drivers and resulting in kernel panic or memory corruption.

How to fix it

Upgrade the Linux kernel to version 6.1.7 or later, or apply the fix from commit ead3e6c79479890444c777fd329afc125fecde48 in the stable tree. Avoid calling the full device removal path from shutdown handlers.

How to confirm the fix worked

Confirm the running kernel version is at least 6.1.7 or contains commit ead3e6c79479890444c777fd329afc125fecde48; test shutdown behavior on representative hardware with IOMMU-enabled devices to verify absence of dereferences.

Typical attack path

1. Gain local access or ability to trigger system shutdown/reboot
2. Initiate shutdown sequence on target kernel
3. arm_smmu_device_shutdown calls iommu_device_unregister without user coordination
4. Dependent drivers perform DMA operations against now-invalid IOMMU groups
5. NULL pointer dereference occurs, causing kernel crash or corruption

How to detect it

Examine kernel logs and crash dumps around shutdown events for IOMMU group NULL pointer dereferences or arm_smmu related faults; correlate with device driver DMA failures immediately preceding panics.

What your security team should do

• Prioritize kernel updates on all systems using arm-smmu-v3 IOMMU hardware
• Review boot and shutdown logs for IOMMU-related NULL dereference patterns before patching
• Test patched kernels in staging environments that replicate production IOMMU configurations
• Monitor for any downstream dependent packages that bundle older kernels