CVE-2022-48984: 
Linux Kernel vulnerability analysis and mitigation

A NULL pointer dereference vulnerability was discovered in the Linux kernel's slcan (Serial Line CAN) driver. The vulnerability (CVE-2022-48984) was identified when the LTP test pty03 caused a crash in slcan due to a freed work structure being accessed. The issue affects Linux kernel versions from 6.0 up to (excluding) 6.0.13, and various 6.1 release candidates (rc1-rc8) (NVD).

The vulnerability occurs when slcan's txwork is freed while still being scheduled. While slcannetdevclose() (netdev side) calls flushwork(&sl->txwork), slcanclose() (tty side) does not. This creates a race condition where if the netdev is never set UP but the tty is stuffed with bytes and forced to wakeup write, the work is scheduled but never flushed. The vulnerability has been assigned a CVSS v3.1 base score of 5.5 (MEDIUM) with vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD, Kernel Patch).

When exploited, this vulnerability results in a kernel NULL pointer dereference, which leads to a system crash. This can cause a denial of service condition, affecting system availability (NVD).

The vulnerability has been fixed by adding an additional flushwork() call to slcanclose() to ensure the work is flushed under all circumstances. The fix was implemented in kernel patches and is available in updated kernel versions (Kernel Patch).