CVE-2022-48801

A flaw was found in the Linux kernel's Industrial I/O (IIO) subsystem. When an error occurs while copying a newly created file descriptor to user space during an IIO buffer control operation, the kernel improperly cleans up the descriptor table. A local user can exploit this issue by interacting with the dangling file descriptor to trigger a use-after-free condition, where the kernel accesses memory that has already been released. This flaw can result in a Denial of Service (DoS) through a system crash or potentially allow local privilege escalation.

This vulnerability is rated as having Low severity for Red Hat enterprise products because exploitation requires local access with permissions to open an Industrial I/O (IIO) device node, a class of hardware rarely present or exposed in standard server deployments. Under default configurations, unprivileged users do not have access to /dev/iio:device* device files. Furthermore, triggering the condition requires deliberately inducing a copy failure to user space during an ioctl call, restricting the blast radius primarily to a local denial of service via a kernel crash on specialized hardware.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.