CVE-2022-48957

What it actually does

Failure to free cmd_buff on error paths in dpaa2_switch_acl_entry_add() and dpaa2_switch_acl_entry_remove() causes a memory leak in the DPAA2 switch driver.

Why it matters to the business

Repeated triggering of error conditions in affected kernel networking code can lead to gradual memory exhaustion, degraded performance, or system instability on Linux hosts using DPAA2 hardware; widespread kernel dependency increases exposure across servers and appliances.

How an attack unfolds

An attacker with local access or the ability to induce errors in the ACL entry handling paths repeatedly triggers the leak paths; over time this depletes kernel memory resources, potentially causing denial of service. Threat actor campaigns listed in 2024 zero-day and Linux kernel resource issues provide context for possible targeted use against exposed systems.

How to fix it

Update the Linux kernel to a version containing commit 54d830e24247fa8361b016dd2069362866f45cb6 or later; apply the fixed version for org/pub/scm/linux/kernel/git/stable/linux.git and any downstream distributions. Reboot systems after kernel upgrade.

How to confirm the fix worked

Confirm the running kernel contains commit 54d830e24247fa8361b016dd2069362866f45cb6 via uname or source inspection; review dpaa2-switch driver source for explicit kfree of cmd_buff on all error exits; monitor memory usage under ACL manipulation workloads.

Typical attack path

1. Obtain local execution or network-adjacent access to a system using the dpaa2-switch driver
2. Trigger error conditions in dpaa2_switch_acl_entry_add() or dpaa2_switch_acl_entry_remove() repeatedly
3. Accumulate unfreed cmd_buff allocations until memory pressure causes instability or crash

How to detect it

Review kernel logs for repeated dpaa2_switch ACL entry errors without corresponding memory release; correlate with memory usage spikes on hosts running vulnerable kernel versions; inspect for presence of threat actor tooling associated with Linux kernel resource or uninitialized use vulnerabilities.

What your security team should do

• Prioritize kernel updates on all systems exposing DPAA2 switch functionality within the CISA remediation window if applicable
• Inventory hosts using the dpaa2-switch driver and schedule staged rollouts
• Monitor EPSS trend and kernel-specific threat actor reports for any increase in observed exploitation