# CVE-2022-48871: linux: In the Linux kernel, the following vulnerability has been resolved:  tty: serial: qcom-geni-serial: fix slab-out-of-b...

CVE-2022-48871 is fixed in linux on 1 platform, first by DEBIAN-CVE-2022-48871, released August 21, 2024. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2022-48871
- Priority: High
- CVSS: 7.1 (high)
- EPSS: 0.0035
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Aug 21, 2024

## Description

In the Linux kernel, the following vulnerability has been resolved:  tty: serial: qcom-geni-serial: fix slab-out-of-bounds on RX FIFO buffer  Driver's probe allocates memory for RX FIFO (port->rx_fifo) based on default RX FIFO depth, e.g. 16.  Later during serial startup the qcom_geni_serial_port_setup() updates the RX FIFO depth (port->rx_fifo_depth) to match real device capabilities, e.g. to 32.  The RX UART handle code will read "port->rx_fifo_depth" number of words into "port->rx_fifo" buffer, thus exceeding the bounds.  This can be observed in certain configurations with Qualcomm Bluetooth HCI UART device and KASAN:    Bluetooth: hci0: QCA Product ID   :0x00000010   Bluetooth: hci0: QCA SOC Version  :0x400a0200   Bluetooth: hci0: QCA ROM Version  :0x00000200   Bluetooth: hci0: QCA Patch Version:0x00000d2b   Bluetooth: hci0: QCA controller version 0x02000200   Bluetooth: hci0: QCA Downloading qca/htbtfw20.tlv   bluetooth hci0: Direct firmware load for qca/htbtfw20.tlv failed with error -2   Bluetooth: hci0: QCA Failed to request file: qca/htbtfw20.tlv (-2)   Bluetooth: hci0: QCA Failed to download patch (-2)   ==================================================================   BUG: KASAN: slab-out-of-bounds in handle_rx_uart+0xa8/0x18c   Write of size 4 at addr ffff279347d578c0 by task swapper/0/0    CPU: 0 PID: 0 Comm: swapper/0 Not tainted 6.1.0-rt5-00350-gb2450b7e00be-dirty #26   Hardware name: Qualcomm Technologies, Inc. Robotics RB5 (DT)   Call trace:    dump_backtrace.part.0+0xe0/0xf0    show_stack+0x18/0x40    dump_stack_lvl+0x8c/0xb8    print_report+0x188/0x488    kasan_report+0xb4/0x100    __asan_store4+0x80/0xa4    handle_rx_uart+0xa8/0x18c    qcom_geni_serial_handle_rx+0x84/0x9c    qcom_geni_serial_isr+0x24c/0x760    __handle_irq_event_percpu+0x108/0x500    handle_irq_event+0x6c/0x110    handle_fasteoi_irq+0x138/0x2cc    generic_handle_domain_irq+0x48/0x64  If the RX FIFO depth changes after probe, be sure to resize the buffer.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | linux Debian 12.15 (bookworm) | 6.1.8-1 | [DEBIAN-CVE-2022-48871](https://patchblox.com/security/data/fix/linux/debian-cve-2022-48871.md) | Aug 21, 2024 |
| Linux | linux Debian 13.5 (trixie) | 6.1.8-1 | [DEBIAN-CVE-2022-48871](https://patchblox.com/security/data/fix/linux/debian-cve-2022-48871.md) | Aug 21, 2024 |
| Linux | linux Debian 14 | 6.1.8-1 | [DEBIAN-CVE-2022-48871](https://patchblox.com/security/data/fix/linux/debian-cve-2022-48871.md) | Aug 21, 2024 |

---

Data as of 2026-11-08T00:53:09Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.