Security readout for executives and security teams
Plain-English summary
This CVE affects Linux on some powerpc64 systems. The kernel BPF JIT could generate an instruction that older processors do not support, causing an illegal-instruction crash. The business risk is concentrated in niche PPC64 estates, not general Linux fleets.
Executive priority
Low for most organizations; moderate only for operators with legacy PPC64 Linux infrastructure where kernel crashes affect availability-sensitive services.
Technical view
The powerpc64 BPF JIT emitted `ldbrx` for BPF endian-conversion paths, but `ldbrx` requires Power ISA v2.06. On older processors such as ppc64 e5500, this could trigger a kernel-mode illegal instruction. The upstream fix limits `ldbrx` use and adds an alternate path for older processors.
Likely exposure
Exposure appears limited to Linux powerpc64 deployments using affected kernels on processors below Power ISA v2.06, especially where BPF JIT paths are exercised. x86, ARM, and newer compliant Power processors are not indicated by the provided sources.
Exploitation context
No active exploitation is cited. The bundle marks KEV as false and provides no exploit reports. The evidence describes a crash found during `test_bpf`, so treat this primarily as stability and availability risk unless vendor guidance says otherwise.
Researcher notes
The provided evidence is narrow but clear: an instruction-selection bug in the powerpc64 BPF JIT. No CVSS, CWE, exploit status, or broad impact statement is supplied. Downstream kernel package status must be verified with the relevant Linux distribution.
Mitigation direction
- Update affected PPC64 kernels to builds containing the referenced stable fixes.
- Prioritize older Power ISA systems, including e5500-class hardware.
- Use vendor or distribution advisories to confirm backported fixed kernel versions.
- If updates are unavailable, seek vendor guidance before relying on workarounds.
Validation and detection
- Inventory Linux powerpc64 systems and processor ISA compatibility.
- Check running kernel versions against vendor fixed packages or stable commits.
- Confirm BPF JIT exposure on affected PPC64 hosts.
- Review crash logs for kernel illegal-instruction events in BPF paths.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2022-48755 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/129c71829d7f46423d95c19e8d87ce956d4c6e1cCVE reference, Linux
- https://git.kernel.org/stable/c/3bfbc00587dc883eaed383558ae512a351c2cd09CVE reference, Linux
- https://git.kernel.org/stable/c/aaccfeeee1630b155e8ff0d6c449d3de1ef86e73CVE reference, Linux
- https://git.kernel.org/stable/c/3f5f766d5f7f95a69a630da3544a1a0cee1cdddfCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.