CVE-2022-48909

What it actually does

Race condition in Linux kernel SMC protocol allows tcp_abort() to discard pending CLC CONFIRM messages after state transition to SMC_ACTIVE, causing the connection token to never reach the peer and preventing passive close, resulting in a permanent connection leak.

Why it matters to the business

Systems running affected Linux kernels may experience gradual resource exhaustion from leaked SMC connections, degrading network performance and availability over time, especially in high-connection environments; the fix has been available for over two years with no known active exploitation campaigns.

How an attack unfolds

An attacker triggers concurrent smc_release and smc_connect_work paths so that tcp_abort discards the CLC CONFIRM message before it is sent; the server never receives the token, the client never receives a close notification, and the connection remains allocated indefinitely.

How to fix it

Upgrade the Linux kernel to commit 2e8d465b83db307f04ad265848f8ab3f78f6918f or later stable releases that contain the fix; apply vendor kernel updates that backport the change; monitor for any future timer-based hardening discussed in the patch.

How to confirm the fix worked

Confirm the running kernel contains commit 2e8d465b83db307f04ad265848f8ab3f78f6918f or an equivalent backport; review SMC connection teardown code paths for the added abort after state transition; test concurrent release/connect workloads to verify no leaks remain.

Typical attack path

1. Establish an SMC connection that enters SMC_INIT state
2. Trigger concurrent release and connect workqueue paths
3. Force tcp_abort to discard the pending CLC CONFIRM
4. Observe that the connection state advances to SMC_ACTIVE without a peer close path
5. Repeat to accumulate leaked kernel resources

How to detect it

Search kernel logs and netlink traces for SMC state transitions that reach SMC_ACTIVE without subsequent close messages; monitor for steadily increasing counts of allocated SMC connections that never terminate; review tcp send buffer discards around abort events.

What your security team should do

• Prioritize kernel updates to the fixed commit on all systems using SMC
• Audit workloads for SMC usage and connection volume to assess exposure
• Add kernel version checks to vulnerability scanning and asset inventory
• Monitor upstream discussions for additional timer-based mitigations