{
  "cveId": "CVE-2022-48644",
  "url": "https://patchblox.com/security/cve/CVE-2022-48644",
  "summary": "CVE-2022-48644 is fixed in linux on 1 platform, first by DEBIAN-CVE-2022-48644, released April 28, 2024. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  net/sched: taprio: avoid disabling offload when...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  net/sched: taprio: avoid disabling offload when it was never enabled  In an incredibly strange API design decision, qdisc-\u003Edestroy() gets called even if qdisc-\u003Einit() never succeeded, not exclusively since commit 87b60cfacf9f (\u0022net_sched: fix error recovery at qdisc creation\u0022), but apparently also earlier (in the case of qdisc_create_dflt()).  The taprio qdisc does not fully acknowledge this when it attempts full offload, because it starts off with q-\u003Eflags = TAPRIO_FLAGS_INVALID in taprio_init(), then it replaces q-\u003Eflags with TCA_TAPRIO_ATTR_FLAGS parsed from netlink (in taprio_change(), tail called from taprio_init()).  But in taprio_destroy(), we call taprio_disable_offload(), and this determines what to do based on FULL_OFFLOAD_IS_ENABLED(q-\u003Eflags).  But looking at the implementation of FULL_OFFLOAD_IS_ENABLED() (a bitwise check of bit 1 in q-\u003Eflags), it is invalid to call this macro on q-\u003Eflags when it contains TAPRIO_FLAGS_INVALID, because that is set to U32_MAX, and therefore FULL_OFFLOAD_IS_ENABLED() will return true on an invalid set of flags.  As a result, it is possible to crash the kernel if user space forces an error between setting q-\u003Eflags = TAPRIO_FLAGS_INVALID, and the calling of taprio_enable_offload(). This is because drivers do not expect the offload to be disabled when it was never enabled.  The error that we force here is to attach taprio as a non-root qdisc, but instead as child of an mqprio root qdisc:  $ tc qdisc add dev swp0 root handle 1: \\ \tmqprio num_tc 8 map 0 1 2 3 4 5 6 7 \\ \tqueues 1@0 1@1 1@2 1@3 1@4 1@5 1@6 1@7 hw 0 $ tc qdisc replace dev swp0 parent 1:1 \\ \ttaprio num_tc 8 map 0 1 2 3 4 5 6 7 \\ \tqueues 1@0 1@1 1@2 1@3 1@4 1@5 1@6 1@7 base-time 0 \\ \tsched-entry S 0x7f 990000 sched-entry S 0x80 100000 \\ \tflags 0x0 clockid CLOCK_TAI Unable to handle kernel paging request at virtual address fffffffffffffff8 [fffffffffffffff8] pgd=0000000000000000, p4d=0000000000000000 Internal error: Oops: 96000004 [#1] PREEMPT SMP Call trace:  taprio_dump\u002B0x27c/0x310  vsc9959_port_setup_tc\u002B0x1f4/0x460  felix_port_setup_tc\u002B0x24/0x3c  dsa_slave_setup_tc\u002B0x54/0x27c  taprio_disable_offload.isra.0\u002B0x58/0xe0  taprio_destroy\u002B0x80/0x104  qdisc_create\u002B0x240/0x470  tc_modify_qdisc\u002B0x1fc/0x6b0  rtnetlink_rcv_msg\u002B0x12c/0x390  netlink_rcv_skb\u002B0x5c/0x130  rtnetlink_rcv\u002B0x1c/0x2c  Fix this by keeping track of the operations we made, and undo the offload only if we actually did it.  I\u0027ve added \u0022bool offloaded\u0022 inside a 4 byte hole between \u0022int clockid\u0022 and \u0022atomic64_t picos_per_byte\u0022. Now the first cache line looks like below:  $ pahole -C taprio_sched net/sched/sch_taprio.o struct taprio_sched {         struct Qdisc * *           qdiscs;               /*     0     8 */         struct Qdisc *             root;                 /*     8     8 */         u32                        flags;                /*    16     4 */         enum tk_offsets            tk_offset;            /*    20     4 */         int                        clockid;              /*    24     4 */         bool                       offloaded;            /*    28     1 */          /* XXX 3 bytes hole, try to pack */          atomic64_t                 picos_per_byte;       /*    32     0 */          /* XXX 8 bytes hole, try to pack */          spinlock_t                 current_entry_lock;   /*    40     0 */          /* XXX 8 bytes hole, try to pack */          struct sched_entry *       current_entry;        /*    48     8 */         struct sched_gate_list *   oper_sched;           /*    56     8 */         /* --- cacheline 1 boundary (64 bytes) --- */",
  "published": "2024-04-28T13:15:07Z",
  "severity": "medium",
  "cvss": 5.5,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
  "epss": 0.00232,
  "epssPercentile": 0.14162,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "6.0.2-1",
      "fix": "DEBIAN-CVE-2022-48644",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-48644",
      "released": "2024-04-28T13:15:07Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "6.0.2-1",
      "fix": "DEBIAN-CVE-2022-48644",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-48644",
      "released": "2024-04-28T13:15:07Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "6.0.2-1",
      "fix": "DEBIAN-CVE-2022-48644",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-48644",
      "released": "2024-04-28T13:15:07Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T00:53:09Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}