CVE-2022-48964

What it actually does

Use-after-free in ravb_rx_gbeth() where napi_gro_receive() may free an skb that is subsequently dereferenced.

Why it matters to the business

Kernel instability or potential code execution on systems using the affected Ethernet driver, leading to crashes, downtime, or compromise of network-connected Linux hosts.

How an attack unfolds

An attacker sends network traffic that reaches the ravb receive path; napi_gro_receive frees the skb and later code dereferences the freed pointer, enabling use-after-free exploitation.

How to fix it

Upgrade the Linux kernel to a version containing commit 601688ee8e8808a23b102fa305b178f27cbd226d or e63c681494dcc0527c625a0a4f59bf10259f5ee0 in the stable trees.

How to confirm the fix worked

Verify the running kernel contains one of the listed fix commits or is newer than the vulnerable revisions in the affected stable branches.

Typical attack path

1. Send crafted Ethernet frames to an interface using the ravb driver
2. Trigger ravb_rx_gbeth path so that napi_gro_receive frees the skb
3. Cause subsequent dereference of the freed skb pointer

How to detect it

Inspect kernel logs for use-after-free warnings or oops messages referencing ravb_rx_gbeth or napi_gro_receive.

What your security team should do

• Apply the referenced kernel commits or newer stable releases to all affected systems
• Prioritize patching on any hosts exposing ravb interfaces to untrusted networks
• Monitor upstream stable updates for additional backports