CVE-2022-48915

What it actually does

A NULL pointer dereference occurs in the Linux kernel thermal core when thermal_genl_cmd_tz_get_trip() invokes get_trip_hyst() on a thermal zone that does not implement the hysteresis callback.

Why it matters to the business

Kernel instability or crashes can occur during thermal management operations on affected Linux and Android devices, increasing operational risk and downtime until patches are applied; low exploit prevalence reduces immediate urgency.

How an attack unfolds

An attacker triggers the thermal generic netlink TZ_GET_TRIP command against a thermal zone lacking a hysteresis definition, causing the kernel to dereference a NULL pointer; similar Linux kernel memory corruption issues have been referenced by threat actors in use-after-free campaigns.

How to fix it

Upgrade the Linux kernel to commit 1c0b51e62a50e9291764d022ed44549e65d6ab9c or later; for affected Qualcomm Android platforms apply SoCVersion 2021-10-05 or newer fixed builds.

How to confirm the fix worked

Verify the presence of the fix commit in the running kernel source or binary; confirm that TZ_GET_TRIP no longer calls get_trip_hyst on zones without hysteresis and test for absence of NULL dereference panics.

Typical attack path

1. Locate or create a thermal zone without a defined get_trip_hyst callback
2. Issue a TZ_GET_TRIP netlink command via thermal_genl
3. Trigger the unconditional call to get_trip_hyst()
4. Cause NULL pointer dereference leading to kernel panic or crash

How to detect it

Search kernel logs and dmesg for oops or panic messages referencing thermal_genl_cmd_tz_get_trip or get_trip_hyst; review netlink thermal command activity around crash timestamps.

What your security team should do

• Apply the referenced kernel and Android fixes to all affected systems
• Monitor kernel logs for thermal-related oops or panics
• Prioritize updates on devices with custom thermal zone configurations