CVE-2022-48696

A flaw was found in the Linux kernel's Serial Peripheral Interface (SPI) regmap subsystem. The calculation of maximum transfer limits fails to account for the overhead of register addresses and padding during raw read and write operations. A local user could exploit this flaw to transmit messages exceeding hardware limits, potentially resulting in data corruption or a denial of service (DoS).

This issue is fixed in RHEL-9.2 and above (including RHEL-8.10):

in (rhel-9.2, rhel-9.3, rhel-9.4, rhel-9.5) regmap: spi: Reserve space for register address/padding
in (rhel-8.8, rhel-8.9, rhel-8.10) regmap: spi: Reserve space for register address/padding

Please note that while RHEL-9 kernel-rt still appears as affected, it has been fixed in the same RHSA as RHEL-9 kernel. This is because from RHEL-9.3 onwards, the kernel and kernel-rt fixes are bundled together in a single errata.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.