CVE-2022-48930

What it actually does

The vulnerability is a deadlock in the RDMA/ib_srp initiator caused by an unnecessary flush_workqueue(system_long_wq) call that can block on pending work items while holding locks required by those items.

Why it matters to the business

Systems using RDMA SRP storage connections may experience kernel deadlocks leading to system unresponsiveness, requiring reboots and interrupting storage-dependent workloads; the issue affects widely deployed Linux kernels with moderate ecosystem prevalence.

How an attack unfolds

An attacker with local access triggers the SRP initiator path that schedules work on system_long_wq and then invokes the flush, causing the deadlock when the work item cannot complete due to lock contention.

How to fix it

Update the Linux kernel to a version containing commit 8cc342508f9e7fdccd2e9758ae9d52aff72dab7f or later; Android devices should apply the March 2022 security updates for versions 10, 11, 12, and 12L.

How to confirm the fix worked

Verify the kernel source contains the referenced commit or that the flush_workqueue(system_long_wq) call has been removed from drivers/infiniband/ulp/srp/ib_srp.c; test SRP connection establishment and teardown under load to confirm absence of deadlock.

Typical attack path

1. Obtain local user or process execution on a system with RDMA/ib_srp loaded
2. Initiate or manipulate an SRP connection that schedules work items
3. Trigger the code path containing the flush_workqueue call
4. Cause deadlock when work cannot complete

How to detect it

Review kernel logs and traces for repeated workqueue flush attempts or hung tasks involving ib_srp; examine system activity around SRP connection events for signs of deadlock.

What your security team should do

• Prioritize kernel updates on systems exposing RDMA or using SRP storage
• Monitor for any remaining downstream dependents still on pre-fix kernels
• Apply the March 2022 Android security patches where applicable