CVE-2022-48934

What it actually does

Improper initialization of the ida_idx variable in nfp_tunnel_add_shared_mac() allows the error-handling path to treat a valid allocated ID (0..0xff) as invalid, causing a resource leak of the IDA index on certain failure paths inside the nfp flower datapath.

Why it matters to the business

On systems using the nfp driver, repeated triggering of the affected allocation paths can exhaust limited kernel resources, leading to degraded network performance or denial-of-service conditions that affect packet processing and may require a reboot.

How an attack unfolds

A local, authenticated user with access to network configuration interfaces or the nfp driver can repeatedly exercise tunnel creation paths that invoke nfp_tunnel_add_shared_mac(); when an error occurs after a valid ID has been obtained, the leak accumulates until resource exhaustion occurs.

How to fix it

Upgrade the Linux kernel to a version containing commit 5ad5886f85b6bd893e3ed19013765fb0c243c069 or later; Qualcomm Android devices should apply the SoCVersion dated 2022-04-05 or newer that includes the corrected nfp flower code.

How to confirm the fix worked

Verify the running kernel contains the fix commit or is newer than the affected stable trees; inspect the nfp/flower source for ida_idx initialized to -1 before the ida_simple_get() call and confirm the error path uses that sentinel value.

Typical attack path

1. Obtain local shell or process with privileges to configure network tunnels on an nfp-equipped host
2. Trigger repeated calls to nfp_tunnel_add_shared_mac() via crafted netlink or ethtool operations
3. Force an error condition after ida_simple_get() succeeds but before cleanup
4. Accumulate leaked IDA indices until the driver can no longer allocate new MAC indices
5. Observe denial of service in flower offload or tunnel functionality

How to detect it

Review kernel logs for repeated nfp flower allocation warnings or failures around tunnel setup; correlate with process activity that performs netlink or ethtool operations on nfp interfaces; no remote network indicators exist.

What your security team should do

• Prioritize kernel upgrades on all hosts that load the nfp driver and use flower offloads
• Apply the fixed SoCVersion 2022-04-05 (or equivalent) on Qualcomm Android platforms
• Monitor for resource-exhaustion symptoms on nfp-equipped systems until patches are deployed
• Restrict local access to network configuration interfaces on affected hosts as a temporary control