CVE-2022-48955

What it actually does

Memory leak in Linux kernel Thunderbolt networking code where failure of tb_ring_alloc_rx() in tbnet_open() leaves the IDA allocated by tb_xdomain_alloc_out_hopid() unreleased, causing gradual resource exhaustion.

Why it matters to the business

Over long periods, systems using affected Thunderbolt networking may experience increased memory consumption leading to performance degradation or instability; low exploit likelihood and no ransomware association reduce immediate operational risk despite wide Linux kernel prevalence.

How an attack unfolds

An attacker would need to repeatedly trigger the specific error path in tbnet_open() on a Thunderbolt-connected system to induce the leak; listed threat actors have not been observed exploiting this particular issue in campaigns.

How to fix it

Update the Linux kernel Thunderbolt net driver to a version containing the fix that adds tb_xdomain_release_out_hopid() on the error path; for openc3/cosmos deployments apply commit b5ab34fe7fa54c0c8171c4aa3caf4e03d6f63bd7 or later.

How to confirm the fix worked

Confirm the presence of the tb_xdomain_release_out_hopid() call in the tbnet_open() error path after applying the patch; review kernel build logs and test Thunderbolt network bring-up under failure injection.

Typical attack path

1. Establish Thunderbolt network connection to target
2. Force tb_ring_alloc_rx() failure condition
3. Repeat to accumulate unreleased IDA allocations
4. Monitor for memory pressure or system impact

How to detect it

Examine kernel logs and memory accounting for repeated Thunderbolt ring allocation failures without corresponding IDA releases; no specific post-exploitation artifacts are known given the nature of the resolved leak.

What your security team should do

• Prioritize kernel updates on systems with Thunderbolt networking enabled
• Monitor memory usage trends on affected hosts as a compensating control
• Review downstream package dependencies for the fixed commit