Security readout for executives and security teams
Plain-English summary
This is a Linux kernel memory-safety bug in IOMMU device probing. Under a failed device probe, one worker could free IOMMU data while another deferred probe still reads it. The source shows a KASAN crash report, not public exploitation evidence.
Executive priority
Treat as a normal-priority kernel maintenance item unless exposed systems are unstable or run affected IOMMU probe paths. There is no cited active exploitation, but kernel memory-safety defects should not be left unpatched indefinitely.
Technical view
CVE-2022-48796 is a use-after-free involving dev->iommu during Linux IOMMU probe failure and deferred_probe_work_func. The of_iommu_configure path may read dev->iommu->fwspec after dev_iommu_free frees the structure. The fix sets dev->iommu to NULL before freeing the dev_iommu object.
Likely exposure
Exposure is most relevant to Linux systems running affected kernel ranges from 5.3 before the referenced stable fixes. The observed trace involves IOMMU, device-tree DMA configuration, and arm_smmu on arm64. Distribution kernel backports may change practical exposure.
Exploitation context
The provided sources do not show active exploitation, and KEV is false. The evidence is a KASAN-detected race during probe failure, suggesting reliability impact or possible kernel memory corruption, but exploitability is not established in the bundle.
Researcher notes
The race is between dev_iommu_free and deferred probe access to dev->iommu->fwspec through of_iommu_configure. The public fix direction is pointer nulling before free. The bundle lacks CVSS, CWE, exploit analysis, and detailed distro applicability.
Mitigation direction
- Identify Linux kernel versions across affected fleets.
- Apply vendor kernel updates containing the referenced stable fixes.
- Check distribution advisories for backported fixes before relying on version strings.
- Prioritize systems using IOMMU-heavy or ARM SMMU platforms if present.
Validation and detection
- Confirm running kernel versions and vendor patch levels.
- Review vendor changelogs for CVE-2022-48796 or the referenced stable commits.
- Check kernel logs for IOMMU probe failures or KASAN use-after-free reports.
- Validate patched kernels in staging before broad rollout.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2022-48796 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/cb86e511e78e796de6947b8f3acca1b7c76fb2ffCVE reference, Linux
- https://git.kernel.org/stable/c/65ab30f6a6952fa9ee13009862736cf8d110e6e5CVE reference, Linux
- https://git.kernel.org/stable/c/f74fc4b5bd533ea3d30ce47cccb8ef8d21fda85aCVE reference, Linux
- https://git.kernel.org/stable/c/b54240ad494300ff0994c4539a531727874381f4CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.