LiveActive security incident?Get immediate response
CVE Record

CVE-2022-48871: tty: serial: qcom-geni-serial: fix slab-out-of-bounds on RX FIFO buffer

In the Linux kernel, the following vulnerability has been resolved: tty: serial: qcom-geni-serial: fix slab-out-of-bounds on RX FIFO buffer Driver's probe allocates memory for RX FIFO (port->rx_fifo) based on default RX FIFO depth, e.g. 16. Later during serial startup the qcom_geni_serial_port_setup() updates the RX FIFO depth (port->rx_fifo_depth) to match real device capabilities, e.g. to 32. The RX UART handle code will read "port->rx_fifo_depth" number of words into "port->rx_fifo" buffer, thus exceeding the bounds. This can be observed in certain configurations with Qualcomm Bluetooth HCI UART device and KASAN: Bluetooth: hci0: QCA Product ID :0x00000010 Bluetooth: hci0: QCA SOC Version :0x400a0200 Bluetooth: hci0: QCA ROM Version :0x00000200 Bluetooth: hci0: QCA Patch Version:0x00000d2b Bluetooth: hci0: QCA controller version 0x02000200 Bluetooth: hci0: QCA Downloading qca/htbtfw20.tlv bluetooth hci0: Direct firmware load for qca/htbtfw20.tlv failed with error -2 Bluetooth: hci0: QCA Failed to request file: qca/htbtfw20.tlv (-2) Bluetooth: hci0: QCA Failed to download patch (-2) ================================================================== BUG: KASAN: slab-out-of-bounds in handle_rx_uart+0xa8/0x18c Write of size 4 at addr ffff279347d578c0 by task swapper/0/0 CPU: 0 PID: 0 Comm: swapper/0 Not tainted 6.1.0-rt5-00350-gb2450b7e00be-dirty #26 Hardware name: Qualcomm Technologies, Inc. Robotics RB5 (DT) Call trace: dump_backtrace.part.0+0xe0/0xf0 show_stack+0x18/0x40 dump_stack_lvl+0x8c/0xb8 print_report+0x188/0x488 kasan_report+0xb4/0x100 __asan_store4+0x80/0xa4 handle_rx_uart+0xa8/0x18c qcom_geni_serial_handle_rx+0x84/0x9c qcom_geni_serial_isr+0x24c/0x760 __handle_irq_event_percpu+0x108/0x500 handle_irq_event+0x6c/0x110 handle_fasteoi_irq+0x138/0x2cc generic_handle_domain_irq+0x48/0x64 If the RX FIFO depth changes after probe, be sure to resize the buffer.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2022-48871 is a Linux kernel bug in Qualcomm GENI serial handling. On affected systems, the driver can write past its receive buffer when hardware reports a larger FIFO depth than initially allocated. This is most relevant to Linux devices using Qualcomm serial hardware, including observed Bluetooth HCI UART configurations.

Executive priority

Treat this as a targeted kernel reliability and potential security issue for Qualcomm-based Linux fleets. It is not documented as broadly exploited, but kernel memory corruption on exposed device classes warrants normal patch-cycle priority, faster where affected hardware is deployed in production.

Technical view

The qcom-geni-serial driver allocated port->rx_fifo during probe using a default FIFO depth, then later updated port->rx_fifo_depth during startup. RX handling used the updated depth to copy words into the older, smaller buffer, causing a KASAN-reported slab out-of-bounds write. The fix resizes the buffer when FIFO depth changes.

Likely exposure

Exposure appears limited to Linux systems using the Qualcomm GENI serial driver and configurations where RX FIFO depth changes after probe. The source specifically mentions certain Qualcomm Bluetooth HCI UART setups. General Linux servers without this hardware path are unlikely to be exposed.

Exploitation context

The provided sources do not show active exploitation, KEV listing, exploit availability, or attacker prerequisites. Evidence is limited to kernel bug details and a KASAN crash trace observed on Qualcomm Robotics RB5 hardware during Bluetooth firmware handling.

Researcher notes

The evidence supports an out-of-bounds kernel write in qcom-geni-serial RX handling caused by allocation and runtime FIFO-depth mismatch. The bundle does not provide CVSS, CWE, exploitability analysis, or complete version-range semantics, so affected-version confirmation should be done against vendor kernels and the referenced commits.

Mitigation direction

  • Update to a Linux kernel containing one of the referenced stable fixes.
  • Check your distribution or device vendor advisory for the exact fixed package version.
  • Prioritize Qualcomm-based embedded, robotics, mobile, or IoT Linux devices.
  • If immediate patching is blocked, review whether qcom-geni-serial is used on the device.

Validation and detection

  • Inventory kernels and hardware using the Qualcomm GENI serial driver.
  • Compare deployed kernel source or packages against the referenced stable commits.
  • Review kernel logs for KASAN or slab-out-of-bounds reports in handle_rx_uart.
  • Confirm vendor kernel updates include the RX FIFO resize fix.
Prepared
Confidence
medium
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2022-48871 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
1ADP providers
5Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxf9d690b6ece7ec9a6ff6b588df95a010ab2d66f9, f9d690b6ece7ec9a6ff6b588df95a010ab2d66f9, f9d690b6ece7ec9a6ff6b588df95a010ab2d66f9, f9d690b6ece7ec9a6ff6b588df95a010ab2d66f9unaffected
LinuxLinux5.7, 0, 5.10.165, 5.15.90, 6.1.8, 6.2affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.