CVE-2022-48788
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk57th percentile - higher than 57% of all known CVEs
Summary
In the Linux kernel, a vulnerability in the nvme-rdma driver was fixed that could lead to a use-after-free in the transport error recovery work. The issue involved a race between checking the controller state and preparing the AER command, potentially causing incorrect behavior.
Risk Assessment
Risk of system crash or potential security compromise in environments using NVMe over RDMA, especially during transport errors.
Recommendation
Update the Linux kernel to a patched version and test systems for stability.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: nvme-rdma: fix possible use-after-free in transport error_recovery work While nvme_rdma_submit_async_event_work is checking the ctrl and queue state before preparing the AER command and scheduling io_work, in order to fully prevent a race where this check is not reliable the error recovery work must flush async_event_work before continuing to destroy the admin queue after setting the ctrl state to RESETTING such that there is no race .submit_async_event and the error recovery handler itself changing the ctrl state.