# CVE-2022-48673: net/smc: Fix possible access to freed memory in link clear

CVE-2022-48673 is fixed in linux on 1 platform, first by DEBIAN-CVE-2022-48673, released May 3, 2024. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2022-48673
- Priority: Routine
- CVSS: 5.5 (Moderate)
- EPSS: 0.0050
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: May 3, 2024
- Weakness: Improper Handling of Exceptional Conditions
- Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-48673

## Description

In the Linux kernel, the following vulnerability has been resolved:  net/smc: Fix possible access to freed memory in link clear  After modifying the QP to the Error state, all RX WR would be completed with WC in IB_WC_WR_FLUSH_ERR status. Current implementation does not wait for it is done, but destroy the QP and free the link group directly. So there is a risk that accessing the freed memory in tasklet context.  Here is a crash example:   BUG: unable to handle page fault for address: ffffffff8f220860  #PF: supervisor write access in kernel mode  #PF: error_code(0x0002) - not-present page  PGD f7300e067 P4D f7300e067 PUD f7300f063 PMD 8c4e45063 PTE 800ffff08c9df060  Oops: 0002 [#1] SMP PTI  CPU: 1 PID: 0 Comm: swapper/1 Kdump: loaded Tainted: G S         OE     5.10.0-0607+ #23  Hardware name: Inspur NF5280M4/YZMB-00689-101, BIOS 4.1.20 07/09/2018  RIP: 0010:native_queued_spin_lock_slowpath+0x176/0x1b0  Code: f3 90 48 8b 32 48 85 f6 74 f6 eb d5 c1 ee 12 83 e0 03 83 ee 01 48 c1 e0 05 48 63 f6 48 05 00 c8 02 00 48 03 04 f5 00 09 98 8e <48> 89 10 8b 42 08 85 c0 75 09 f3 90 8b 42 08 85 c0 74 f7 48 8b 32  RSP: 0018:ffffb3b6c001ebd8 EFLAGS: 00010086  RAX: ffffffff8f220860 RBX: 0000000000000246 RCX: 0000000000080000  RDX: ffff91db1f86c800 RSI: 000000000000173c RDI: ffff91db62bace00  RBP: ffff91db62bacc00 R08: 0000000000000000 R09: c00000010000028b  R10: 0000000000055198 R11: ffffb3b6c001ea58 R12: ffff91db80e05010  R13: 000000000000000a R14: 0000000000000006 R15: 0000000000000040  FS:  0000000000000000(0000) GS:ffff91db1f840000(0000) knlGS:0000000000000000  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033  CR2: ffffffff8f220860 CR3: 00000001f9580004 CR4: 00000000003706e0  DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000  DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400  Call Trace:   <IRQ>   _raw_spin_lock_irqsave+0x30/0x40   mlx5_ib_poll_cq+0x4c/0xc50 [mlx5_ib]   smc_wr_rx_tasklet_fn+0x56/0xa0 [smc]   tasklet_action_common.isra.21+0x66/0x100   __do_softirq+0xd5/0x29c   asm_call_irq_on_stack+0x12/0x20   </IRQ>   do_softirq_own_stack+0x37/0x40   irq_exit_rcu+0x9d/0xa0   sysvec_call_function_single+0x34/0x80   asm_sysvec_call_function_single+0x12/0x20

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | linux Debian 12.15 (bookworm) | 5.19.11-1 | [DEBIAN-CVE-2022-48673](https://patchblox.com/security/data/fix/linux/debian-cve-2022-48673.md) | May 3, 2024 |
| Linux | linux Debian 13.5 (trixie) | 5.19.11-1 | [DEBIAN-CVE-2022-48673](https://patchblox.com/security/data/fix/linux/debian-cve-2022-48673.md) | May 3, 2024 |
| Linux | linux Debian 14 | 5.19.11-1 | [DEBIAN-CVE-2022-48673](https://patchblox.com/security/data/fix/linux/debian-cve-2022-48673.md) | May 3, 2024 |

---

Data as of 2026-11-08T00:53:09Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.