{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2022-48721","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2024-06-20T11:09:39.051Z","datePublished":"2024-06-20T11:13:12.668Z","dateUpdated":"2026-08-05T08:51:56.989Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T08:51:56.989Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/smc: Forward wakeup to smc socket waitqueue after fallback\n\nWhen we replace TCP with SMC and a fallback occurs, there may be\nsome socket waitqueue entries remaining in smc socket->wq, such\nas eppoll_entries inserted by userspace applications.\n\nAfter the fallback, data flows over TCP/IP and only clcsocket->wq\nwill be woken up. Applications can't be notified by the entries\nwhich were inserted in smc socket->wq before fallback. So we need\na mechanism to wake up smc socket->wq at the same time if some\nentries remaining in it.\n\nThe current workaround is to transfer the entries from smc socket->wq\nto clcsock->wq during the fallback. But this may cause a crash\nlike this:\n\n general protection fault, probably for non-canonical address 0xdead000000000100: 0000 [#1] PREEMPT SMP PTI\n CPU: 3 PID: 0 Comm: swapper/3 Kdump: loaded Tainted: G E     5.16.0+ #107\n RIP: 0010:__wake_up_common+0x65/0x170\n Call Trace:\n  <IRQ>\n  __wake_up_common_lock+0x7a/0xc0\n  sock_def_readable+0x3c/0x70\n  tcp_data_queue+0x4a7/0xc40\n  tcp_rcv_established+0x32f/0x660\n  ? sk_filter_trim_cap+0xcb/0x2e0\n  tcp_v4_do_rcv+0x10b/0x260\n  tcp_v4_rcv+0xd2a/0xde0\n  ip_protocol_deliver_rcu+0x3b/0x1d0\n  ip_local_deliver_finish+0x54/0x60\n  ip_local_deliver+0x6a/0x110\n  ? tcp_v4_early_demux+0xa2/0x140\n  ? tcp_v4_early_demux+0x10d/0x140\n  ip_sublist_rcv_finish+0x49/0x60\n  ip_sublist_rcv+0x19d/0x230\n  ip_list_rcv+0x13e/0x170\n  __netif_receive_skb_list_core+0x1c2/0x240\n  netif_receive_skb_list_internal+0x1e6/0x320\n  napi_complete_done+0x11d/0x190\n  mlx5e_napi_poll+0x163/0x6b0 [mlx5_core]\n  __napi_poll+0x3c/0x1b0\n  net_rx_action+0x27c/0x300\n  __do_softirq+0x114/0x2d2\n  irq_exit_rcu+0xb4/0xe0\n  common_interrupt+0xba/0xe0\n  </IRQ>\n  <TASK>\n\nThe crash is caused by privately transferring waitqueue entries from\nsmc socket->wq to clcsock->wq. The owners of these entries, such as\nepoll, have no idea that the entries have been transferred to a\ndifferent socket wait queue and still use original waitqueue spinlock\n(smc socket->wq.wait.lock) to make the entries operation exclusive,\nbut it doesn't work. The operations to the entries, such as removing\nfrom the waitqueue (now is clcsock->wq after fallback), may cause a\ncrash when clcsock waitqueue is being iterated over at the moment.\n\nThis patch tries to fix this by no longer transferring wait queue\nentries privately, but introducing own implementations of clcsock's\ncallback functions in fallback situation. The callback functions will\nforward the wakeup to smc socket->wq if clcsock->wq is actually woken\nup and smc socket->wq has remaining entries."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires a local process to create an AF_SMC (or TCP_ULP smc) socket, attach epoll waiters, and trigger SMC→TCP fallback; remote packets alone cannot set up the vulnerable waitqueue transfer.\nAC:L - The attacker controls both sides of the race—epoll_ctl/close removing waiters while send/recv or loopback traffic wakes the clcsock waitqueue—so the lock-mismatch corruption can be triggered reliably.\nPR:L - AF_SMC SOCK_STREAM sockets can be created by an unprivileged user with no capability checks, and fallback occurs automatically when connecting to a non-SMC TCP peer (or via unsupported options like TCP_FASTOPEN).\nUI:N - No victim action is required; the attacker fully drives socket creation, epoll registration, connect/fallback, and the racing wake/remove operations.\nS:U - Impact is confined to the local kernel/OS authority (crash or privilege escalation within the same host); it does not cross VM, IOMMU, or other security boundaries.\nC:H - Concurrent unlock-protected list_del of epoll wait entries while softirq walks the spliced waitqueue is a use-after-free of wait_queue_entry/eppoll_entry memory, which can be reused to obtain arbitrary kernel read primitives.\nI:H - The same UAF targets wait_queue_entry objects that contain a callable func pointer invoked from __wake_up_common in softirq context, enabling heap reuse for control-flow hijacking and arbitrary write/code execution.\nA:H - The bug demonstrably causes a kernel general protection fault (LIST_POISON in __wake_up_common during TCP receive softirq), producing a full kernel oops/DoS."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/smc/af_smc.c","net/smc/smc.h"],"versions":[{"version":"fb92e025baa73e99250b79ab64f4e088d2888993","lessThan":"0ef6049f664941bc0f75828b3a61877635048b27","status":"affected","versionType":"git"},{"version":"2153bd1e3d3dbf6a3403572084ef6ed31c53c5f0","lessThan":"504078fbe9dd570d685361b57784a6050bc40aaa","status":"affected","versionType":"git"},{"version":"2153bd1e3d3dbf6a3403572084ef6ed31c53c5f0","lessThan":"341adeec9adad0874f29a0a1af35638207352a39","status":"affected","versionType":"git"},{"version":"d6e981ec9491be5ec46d838b1151e7edefe607f5","status":"affected","versionType":"git"},{"version":"ff6eeb627898c179aac421af5d6515d3f50b84df","status":"affected","versionType":"git"},{"version":"5.15.7","lessThan":"5.15.22","status":"affected","versionType":"semver"},{"version":"5.4.164","lessThan":"5.5","status":"affected","versionType":"semver"},{"version":"5.10.84","lessThan":"5.11","status":"affected","versionType":"semver"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/smc/af_smc.c","net/smc/smc.h"],"versions":[{"version":"5.16","status":"affected"},{"version":"0","lessThan":"5.16","status":"unaffected","versionType":"semver"},{"version":"5.15.22","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"5.16.8","lessThanOrEqual":"5.16.*","status":"unaffected","versionType":"semver"},{"version":"5.17","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15.7","versionEndExcluding":"5.15.22"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.16","versionEndExcluding":"5.16.8"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.16","versionEndExcluding":"5.17"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.4.164"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.10.84"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/0ef6049f664941bc0f75828b3a61877635048b27"},{"url":"https://git.kernel.org/stable/c/504078fbe9dd570d685361b57784a6050bc40aaa"},{"url":"https://git.kernel.org/stable/c/341adeec9adad0874f29a0a1af35638207352a39"}],"title":"net/smc: Forward wakeup to smc socket waitqueue after fallback","x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-03T15:25:00.192Z"},"title":"CVE Program Container","references":[{"url":"https://git.kernel.org/stable/c/0ef6049f664941bc0f75828b3a61877635048b27","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/504078fbe9dd570d685361b57784a6050bc40aaa","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/341adeec9adad0874f29a0a1af35638207352a39","tags":["x_transferred"]}]},{"metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2022-48721","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2024-09-10T17:11:16.258278Z"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2024-09-11T17:34:49.624Z"}}]}}