CVE-2022-48905

What it actually does

Failure to free a reset work item during flush of the ibmvnic reset work queue results in a small persistent memory leak in the Linux kernel driver.

Why it matters to the business

Gradual memory consumption on systems using the ibmvnic driver may eventually affect stability or require reboots in long-running virtualized or cloud environments; low prevalence and no ransomware usage reduce urgency.

How an attack unfolds

An attacker with local or network-adjacent access repeatedly triggers ibmvnic resets to cause repeated work-queue flushes, accumulating unreleased memory; the listed Linux Kernel Use-After-Free threat actor context does not apply as the flaw is a leak rather than a use-after-free.

How to fix it

Apply the fix commit 786576c03b313a9ff6585458aa0dfd039d897f51 in the Linux kernel; for affected Android components (frameworks/base, external/robolectric-shadows, packages/apps/ManagedProvisioning) ensure November 2021 monthly updates or later are installed.

How to confirm the fix worked

Confirm the fix commit is present in the running kernel source tree or verify package versions match the listed fixed releases; monitor kernel memory statistics before and after resets.

Typical attack path

1. Obtain ability to trigger ibmvnic interface resets
2. Cause repeated flush operations on the reset work queue
3. Accumulate leaked memory over many cycles
4. Observe resource exhaustion or instability

How to detect it

Examine kernel logs and slab allocator statistics for repeated ibmvnic reset activity; no specific post-exploitation artifacts are expected given the leak-only nature of the flaw.

What your security team should do

• Prioritize kernel updates on systems exposing ibmvnic interfaces
• Review downstream dependents in the Linux kernel ecosystem for backports
• Include memory-leak checks in routine kernel hygiene scans