LiveActive security incident?Get immediate response
CVE Record

CVE-2022-48925: RDMA/cma: Do not change route.addr.src_addr outside state checks

In the Linux kernel, the following vulnerability has been resolved: RDMA/cma: Do not change route.addr.src_addr outside state checks If the state is not idle then resolve_prepare_src() should immediately fail and no change to global state should happen. However, it unconditionally overwrites the src_addr trying to build a temporary any address. For instance if the state is already RDMA_CM_LISTEN then this will corrupt the src_addr and would cause the test in cma_cancel_operation(): if (cma_any_addr(cma_src_addr(id_priv)) && !id_priv->cma_dev) Which would manifest as this trace from syzkaller: BUG: KASAN: use-after-free in __list_add_valid+0x93/0xa0 lib/list_debug.c:26 Read of size 8 at addr ffff8881546491e0 by task syz-executor.1/32204 CPU: 1 PID: 32204 Comm: syz-executor.1 Not tainted 5.12.0-rc8-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:79 [inline] dump_stack+0x141/0x1d7 lib/dump_stack.c:120 print_address_description.constprop.0.cold+0x5b/0x2f8 mm/kasan/report.c:232 __kasan_report mm/kasan/report.c:399 [inline] kasan_report.cold+0x7c/0xd8 mm/kasan/report.c:416 __list_add_valid+0x93/0xa0 lib/list_debug.c:26 __list_add include/linux/list.h:67 [inline] list_add_tail include/linux/list.h:100 [inline] cma_listen_on_all drivers/infiniband/core/cma.c:2557 [inline] rdma_listen+0x787/0xe00 drivers/infiniband/core/cma.c:3751 ucma_listen+0x16a/0x210 drivers/infiniband/core/ucma.c:1102 ucma_write+0x259/0x350 drivers/infiniband/core/ucma.c:1732 vfs_write+0x28e/0xa30 fs/read_write.c:603 ksys_write+0x1ee/0x250 fs/read_write.c:658 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x44/0xae This is indicating that an rdma_id_private was destroyed without doing cma_cancel_listens(). Instead of trying to re-use the src_addr memory to indirectly create an any address derived from the dst build one explicitly on the stack and bind to that as any other normal flow would do. rdma_bind_addr() will copy it over the src_addr once it knows the state is valid. This is similar to commit bc0bdc5afaa7 ("RDMA/cma: Do not change route.addr.src_addr.ss_family")

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This is a Linux kernel RDMA connection-manager bug that can corrupt internal state and lead to a use-after-free. The public record shows a syzkaller crash trace, not confirmed real-world exploitation. Business urgency depends on whether affected systems expose or use RDMA/UCMA functionality.

Executive priority

Treat as targeted remediation rather than broad emergency response unless RDMA is used in production. Patch RDMA-capable Linux systems through normal kernel maintenance, escalating for storage, HPC, or low-latency environments where RDMA is operationally important.

Technical view

The flaw is in RDMA/cma resolve_prepare_src(). It changed route.addr.src_addr before validating connection state, so non-idle states such as RDMA_CM_LISTEN could corrupt src_addr and bypass expected listen cleanup, producing a KASAN use-after-free in rdma_listen/ucma_listen paths.

Likely exposure

Likely limited to Linux systems with the affected RDMA core code and usable RDMA/UCMA interfaces. The source bundle lists Linux 5.10, 5.10.103, 5.15.26, 5.16.12, and 5.17, but version semantics are incomplete.

Exploitation context

The source evidence is a syzkaller-discovered kernel crash trace. KEV is false, and no cited source in the bundle states active exploitation, public weaponization, remote exploitability, or impact beyond the observed use-after-free condition.

Researcher notes

Validation should focus on affected kernel lineage and RDMA/UCMA reachability. The record describes a state-management bug and stable kernel fixes, but does not provide CVSS, CWE, exploit status, or distribution-specific package boundaries.

Mitigation direction

  • Apply Linux kernel updates containing the referenced stable fixes.
  • Prioritize systems using RDMA, InfiniBand, RoCE, or UCMA interfaces.
  • Check distribution vendor advisories for exact fixed package versions.
  • Disable or restrict unnecessary RDMA/UCMA exposure where operationally feasible.

Validation and detection

  • Inventory Linux kernel versions across RDMA-capable hosts.
  • Confirm whether RDMA/UCMA modules or devices are present and used.
  • Map running kernels to vendor fixed builds or referenced stable commits.
  • Review kernel logs for RDMA/cma or KASAN use-after-free crashes.
Prepared
Confidence
medium
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2022-48925 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
1ADP providers
5Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux732d41c545bb359cbb8c94698bdc1f8bcf82279c, 732d41c545bb359cbb8c94698bdc1f8bcf82279c, 732d41c545bb359cbb8c94698bdc1f8bcf82279c, 732d41c545bb359cbb8c94698bdc1f8bcf82279cunaffected
LinuxLinux5.10, 0, 5.10.103, 5.15.26, 5.16.12, 5.17affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.