CVE-2022-48960

What it actually does

The vulnerability allows a use-after-free condition in the hix5hd2_rx() function when napi_gro_receive() frees an skb that is subsequently dereferenced.

Why it matters to the business

Systems running affected Linux kernel versions on Hisilicon hardware face elevated risk of kernel crashes, potential privilege escalation, or remote code execution; widespread kernel usage amplifies operational disruption and patching urgency despite low exploit probability.

How an attack unfolds

An attacker sends crafted network traffic to trigger the receive path in the affected driver, causing napi_gro_receive() to free the skb; subsequent dereference then results in use-after-free that may be leveraged for memory corruption or code execution. Mentioned threat actors have targeted other Linux kernel issues but no confirmed campaigns exploit this specific flaw.

How to fix it

Update the Linux kernel to a version containing commit 179499e7a240b2ef590f05eb379c810c26bbc8a4 or later; apply the stable patch that eliminates the post-napi_gro_receive dereference.

How to confirm the fix worked

Verify the running kernel includes commit 179499e7a240b2ef590f05eb379c810c26bbc8a4; inspect source for removal of skb dereference after napi_gro_receive() and test with network traffic that exercises the receive path.

Typical attack path

1. Identify target systems running vulnerable kernel versions with the hix5hd2 network driver
2. Craft and transmit network packets that reach hix5hd2_rx()
3. Trigger napi_gro_receive() to free the skb
4. Dereference the freed skb to induce use-after-free
5. Exploit resulting memory state for kernel-level impact

How to detect it

Review kernel logs and network stack traces for use-after-free reports involving hix5hd2_rx or napi_gro_receive; correlate with packet captures showing unusual receive activity on Hisilicon interfaces. No confirmed threat actor IOCs are associated with this CVE.

What your security team should do

• Prioritize kernel upgrades on all Hisilicon-based systems within standard maintenance windows
• Monitor EPSS and KEV updates for any change in exploit availability
• Restrict network exposure of affected devices where upgrades are delayed
• Include the fixed commit hash in automated kernel build and deployment pipelines