CVE-2022-48985
A race condition in the Linux kernel's mana network driver could allow concurrent access to a per-CQ variable after NAPI completion, leading to memory corruption and a system panic. The flaw was fixed by saving the variable locally before completing NAPI work and adding a firmware flag to indicate the fix. Updating the kernel to a version that includes this patch resolves the issue.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Linux systems using the mana network driver (affected kernel versions as listed in the CPE data).
Real-world impact
An attacker could trigger the race to cause memory corruption, resulting in a kernel panic and denial of service.
Why this severity
CVSS v3.1 base score 9.8 (Critical) due to network‑adjacent attack vector, low complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.
What to do about it
- 011. Obtain the latest Linux kernel update from your distribution that includes the fix for CVE-2022-48985 (the patch that resolves the mana driver race condition).
- 022. Install the kernel update using your system's package manager or update mechanism.
- 033. Reboot the system to load the patched kernel.
NVD-referenced vendor advisory (the NVD description states the vulnerability has been resolved in the Linux kernel).
Timeline
- Oct 21, 2024 · Oct 21, 2024PublishedDisclosed and added to the National Vulnerability Database.
- Aug 4, 2026 · 2d agoAdvisory updatedThe NVD record was last revised.
- Aug 4, 2026 · 1d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.