LiveActive security incident?Get immediate response
CVE Record

CVE-2022-48790: nvme: fix a possible use-after-free in controller reset during load

In the Linux kernel, the following vulnerability has been resolved: nvme: fix a possible use-after-free in controller reset during load Unlike .queue_rq, in .submit_async_event drivers may not check the ctrl readiness for AER submission. This may lead to a use-after-free condition that was observed with nvme-tcp. The race condition may happen in the following scenario: 1. driver executes its reset_ctrl_work 2. -> nvme_stop_ctrl - flushes ctrl async_event_work 3. ctrl sends AEN which is received by the host, which in turn schedules AEN handling 4. teardown admin queue (which releases the queue socket) 5. AEN processed, submits another AER, calling the driver to submit 6. driver attempts to send the cmd ==> use-after-free In order to fix that, add ctrl state check to validate the ctrl is actually able to accept the AER submission. This addresses the above race in controller resets because the driver during teardown should: 1. change ctrl state to RESETTING 2. flush async_event_work (as well as other async work elements) So after 1,2, any other AER command will find the ctrl state to be RESETTING and bail out without submitting the AER.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2022-48790 is a Linux kernel NVMe bug where a controller reset can race with async event handling and cause use-after-free. The source says it was observed with nvme-tcp. Business risk is mainly Linux host stability and kernel memory safety in systems using affected NVMe paths.

Executive priority

Handle through normal-to-expedited Linux kernel patching, with higher priority for production storage hosts using NVMe/TCP. There is no source-backed active exploitation signal, but kernel use-after-free bugs deserve timely remediation.

Technical view

During NVMe controller reset, async event work can be flushed, the admin queue torn down, and a later AEN handler may submit another AER through freed resources. The fix adds a controller state check so AER submission stops when the controller is resetting.

Likely exposure

Exposure is most likely on Linux systems using affected kernel versions and NVMe controller paths, especially nvme-tcp. The bundle lists Linux as affected across versions including 4.15 through 5.17-era entries, but does not provide distribution-specific package names.

Exploitation context

The bundle does not cite active exploitation, and KEV is false. It describes a race condition observed with nvme-tcp, not a public exploit. Preconditions, attacker control, and full security impact are not established in the provided sources.

Researcher notes

Key uncertainty is impact. The source documents a use-after-free race and the state-check fix, but not privilege boundaries, exploitability, CVSS, or distribution package status. Validate against kernel commits and downstream backports before declaring systems fixed.

Mitigation direction

  • Apply Linux kernel updates containing the referenced stable fixes.
  • Check distribution vendor advisories for backported kernel fixes.
  • Prioritize hosts using NVMe over TCP or active NVMe reset paths.
  • Reduce reliance on nvme-tcp on unpatched critical hosts where practical.

Validation and detection

  • Inventory Linux kernel versions across servers and appliances.
  • Identify systems using NVMe and nvme-tcp storage paths.
  • Confirm installed kernel includes the referenced upstream stable fix.
  • Review logs for NVMe controller reset instability on affected hosts.
Prepared
Confidence
medium
Sources
8

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2022-48790 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
2ADP providers
7Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container
CISA-ADPCISA ADP Vulnrichment
other:ssvc

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxad22c355b707a8d8d48e282aadc01c0b0604b2e9, ad22c355b707a8d8d48e282aadc01c0b0604b2e9, ad22c355b707a8d8d48e282aadc01c0b0604b2e9, ad22c355b707a8d8d48e282aadc01c0b0604b2e9, ad22c355b707a8d8d48e282aadc01c0b0604b2e9, ad22c355b707a8d8d48e282aadc01c0b0604b2e9unaffected
LinuxLinux4.15, 0, 4.19.231, 5.4.181, 5.10.102, 5.15.25, 5.16.11, 5.17affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.