LiveActive security incident?Get immediate response
CVE Record

CVE-2022-48872: misc: fastrpc: Fix use-after-free race condition for maps

In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: Fix use-after-free race condition for maps It is possible that in between calling fastrpc_map_get() until map->fl->lock is taken in fastrpc_free_map(), another thread can call fastrpc_map_lookup() and get a reference to a map that is about to be deleted. Rewrite fastrpc_map_get() to only increase the reference count of a map if it's non-zero. Propagate this to callers so they can know if a map is about to be deleted. Fixes this warning: refcount_t: addition on 0; use-after-free. WARNING: CPU: 5 PID: 10100 at lib/refcount.c:25 refcount_warn_saturate ... Call trace: refcount_warn_saturate [fastrpc_map_get inlined] [fastrpc_map_lookup inlined] fastrpc_map_create fastrpc_internal_invoke fastrpc_device_ioctl __arm64_sys_ioctl invoke_syscall

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2022-48872 is a Linux kernel FastRPC use-after-free race. In some timing conditions, one thread can access a map object while another is deleting it. The source bundle does not provide a CVSS score, confirmed impact, or evidence of exploitation.

Executive priority

Treat this as a kernel maintenance priority, not an emergency based on current evidence. Escalate for platforms exposing FastRPC to less-trusted local workloads, because use-after-free bugs can become stability or privilege-boundary risks even when impact is not fully documented.

Technical view

The flaw is in Linux kernel misc/fastrpc map reference handling. fastrpc_map_lookup() could obtain a reference after fastrpc_map_get() and before fastrpc_free_map() takes map->fl->lock, triggering refcount use after free. The fix only increments references when the count is non-zero and signals deletion to callers.

Likely exposure

Exposure is most likely on Linux systems running affected kernel versions where the FastRPC driver is present and reachable. The bundle lists Linux as affected but does not identify specific distributions, devices, configurations, or attack prerequisites.

Exploitation context

No active exploitation is stated. The CVE is not marked KEV in the provided bundle, and the supplied sources only describe a kernel race and warning trace, not public exploit activity or weaponized abuse.

Researcher notes

Evidence is limited to the upstream CVE text and stable commit references. The record does not provide CVSS, CWE, exploitability conditions, affected distribution matrices, or a demonstrated security impact beyond the refcount warning and use-after-free race.

Mitigation direction

  • Apply Linux kernel or distribution updates that include the referenced stable fixes.
  • Check vendor kernel advisories for exact affected package versions and backports.
  • Prioritize systems where untrusted users or workloads can reach FastRPC interfaces.
  • Consider reducing FastRPC exposure where it is not operationally required.
  • Track distribution-specific remediation because upstream commit presence may differ from package version.

Validation and detection

  • Confirm the running kernel includes one of the referenced stable fix commits or vendor backport.
  • Inventory systems for FastRPC driver availability and affected kernel versions.
  • Review kernel logs for refcount warnings matching the FastRPC map trace.
  • Validate that kernel updates were applied and systems rebooted into the fixed kernel.
  • Regression-test workloads that depend on FastRPC after updating.
Prepared
Confidence
medium
Sources
7

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2022-48872 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
1ADP providers
6Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxc68cfb718c8f97b7f7a50ed66be5feb42d0c8988, c68cfb718c8f97b7f7a50ed66be5feb42d0c8988, c68cfb718c8f97b7f7a50ed66be5feb42d0c8988, c68cfb718c8f97b7f7a50ed66be5feb42d0c8988, c68cfb718c8f97b7f7a50ed66be5feb42d0c8988unaffected
LinuxLinux5.1, 0, 5.4.230, 5.10.165, 5.15.90, 6.1.8, 6.2affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.