LiveActive security incident?Get immediate response
CVE Record

CVE-2022-48985: net: mana: Fix race on per-CQ variable napi work_done

In the Linux kernel, the following vulnerability has been resolved: net: mana: Fix race on per-CQ variable napi work_done After calling napi_complete_done(), the NAPIF_STATE_SCHED bit may be cleared, and another CPU can start napi thread and access per-CQ variable, cq->work_done. If the other thread (for example, from busy_poll) sets it to a value >= budget, this thread will continue to run when it should stop, and cause memory corruption and panic. To fix this issue, save the per-CQ work_done variable in a local variable before napi_complete_done(), so it won't be corrupted by a possible concurrent thread after napi_complete_done(). Also, add a flag bit to advertise to the NIC firmware: the NAPI work_done variable race is fixed, so the driver is able to reliably support features like busy_poll.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's Takeunknown

Analyst readout for executives and security teams

Plain-English summary

CVE-2022-48985 is a Linux kernel bug in the MANA network driver. A race condition in NAPI completion handling can corrupt memory and cause a kernel panic. The source bundle does not provide CVSS, CWE, or active exploitation evidence, so business risk depends on whether affected kernels and this driver are present.

Executive priority

Treat this as a targeted kernel stability risk, not a confirmed broad exploitation emergency. Prioritize affected Linux hosts using the MANA driver, especially production network workloads where kernel panic would affect availability.

Technical view

The bug involves concurrent access to the per-completion-queue cq->work_done variable after napi_complete_done() may clear scheduling state. Another CPU, including busy_poll activity, can alter work_done and let processing continue past its intended budget, causing memory corruption and panic. The fix stores work_done locally before completion and advertises the driver-side race fix to firmware.

Likely exposure

Exposure appears limited to Linux systems running affected kernel builds with the MANA network driver path in use. The bundle lists Linux 5.15, 6.0.13, 6.1, and related stable commits, but does not provide complete deployment context or distribution-specific package status.

Exploitation context

The bundle does not show CISA KEV listing or any cited active exploitation. The described impact is local kernel memory corruption and panic through a driver race condition. No public exploit status, attacker prerequisites, or reachable remote attack path are established by the provided sources.

Researcher notes

Evidence supports a race-condition fix in the Linux kernel MANA driver. The prompt does not include CVSS, CWE, distribution advisories, exploit reports, or exact package mappings. Avoid broad claims beyond affected kernel and driver contexts until vendor advisories are reviewed.

Mitigation direction

  • Inventory Linux hosts for affected kernel versions and MANA driver usage.
  • Update to a kernel containing one of the referenced stable fixes.
  • Check Linux vendor or distribution advisories for backported package status.
  • Prioritize systems where MANA networking and busy polling are enabled.
  • Plan reboot or live-patching procedures according to normal kernel update policy.

Validation and detection

  • Confirm running kernel versions against vendor-fixed builds or referenced stable commits.
  • Check whether the MANA driver is loaded on each host.
  • Review kernel logs for MANA, NAPI, memory corruption, or panic events.
  • Verify post-update kernel build includes the stable fix commit.
  • Document distribution package names and fixed versions for audit evidence.
Prepared
Confidence
medium
Sources
5

Public sources used

Based on public source material and reviewed before publication.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2022-48985 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
1ADP providers
4Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxe1b5683ff62e7b328317aec08869495992053e9d, e1b5683ff62e7b328317aec08869495992053e9d, e1b5683ff62e7b328317aec08869495992053e9dunaffected
LinuxLinux5.15, 0, 5.15.83, 6.0.13, 6.1affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.