CVE-2022-48985

What it actually does

Race condition in Linux kernel MANA driver where cq->work_done can be concurrently modified after napi_complete_done() clears NAPIF_STATE_SCHED, allowing a thread (e.g., busy_poll) to set a value >= budget and cause the original thread to continue, resulting in memory corruption and kernel panic.

Why it matters to the business

Kernel panics on Linux systems using the MANA network driver can cause unplanned downtime and service disruption, particularly in environments relying on busy polling or high-performance networking; widespread Linux kernel usage increases exposure across servers and cloud workloads.

How an attack unfolds

An attacker triggers network activity engaging the NAPI path on a MANA CQ, times a concurrent busy_poll or similar thread to race after napi_complete_done(), overwrites the per-CQ work_done variable to >= budget, and forces continued execution that corrupts memory and panics the kernel; listed threat actors have targeted similar Linux kernel races in espionage and financially motivated campaigns.

How to fix it

Upgrade the Linux kernel to the fixed commit fe50a9bbeb1f042e756c5cfa7708112c944368de or later stable releases that include the local-variable save of work_done before napi_complete_done() and the new firmware-advertised flag; apply vendor-supplied kernel updates promptly.

How to confirm the fix worked

Verify the running kernel contains commit fe50a9bbeb1f042e756c5cfa7708112c944368de, confirm the NAPI race fix flag is advertised to firmware, and test under load with busy_poll enabled to ensure no panics occur on concurrent access.

Typical attack path

1. Send or induce network traffic that engages the MANA driver's NAPI completion path
2. Trigger a concurrent thread (busy_poll or equivalent) immediately after napi_complete_done()
3. Race to set cq->work_done >= budget from the second thread
4. Cause the original NAPI thread to continue execution beyond the intended stop point
5. Trigger memory corruption leading to kernel panic

How to detect it

Search kernel logs and crash dumps for panics or oops messages involving mana driver, napi_complete_done, or work_done variable corruption; review audit logs for unusual busy_poll activity coinciding with network events on MANA interfaces.

What your security team should do

• Prioritize kernel upgrades to the fixed commit on all systems using the MANA driver
• Monitor for kernel oops/panics referencing mana or napi work_done
• Disable busy_poll temporarily on unpatched systems if feasible
• Track EPSS and threat actor activity for similar Linux kernel races