CVE-2022-48807: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-48807 affects the Linux kernel's ice driver, specifically related to the LAG (Link Aggregation) NETDEVUNREGISTER handler. The vulnerability was discovered and resolved in July 2024. The issue occurs in the ice driver's handling of NETDEVBONDINGINFO LAG unlink notification and NETDEVUNREGISTER calls (Kernel Git).

The vulnerability stems from using the same handler for both NETDEVBONDINGINFO LAG unlink notification and NETDEVUNREGISTER calls, despite the netdevnotifierinfo having different structures depending on the event type. This mismatch manifests as a BUG: KASAN stack-out-of-bounds error. The issue was fixed by creating a handler specific to NETDEVUNREGISTER that only processes valid elements in the netdevnotifierinfo struct for the NETDEV_UNREGISTER event (Kernel Git).

The vulnerability could lead to a kernel crash due to the KASAN (Kernel Address Sanitizer) detecting stack-out-of-bounds memory access, potentially affecting system stability and availability (Kernel Git).

The issue has been fixed in the Linux kernel by implementing a separate handler for NETDEVUNREGISTER events and removing an unbalanced devput on the peer_netdev. Users should update their kernel to a version containing the fix (Kernel Git).