PT-2023-9436

CVE-2022-48871

Published

2023-01-09

Updated

2025-09-29

Description by

CVSS 3.1

8.8

High

MetricsAV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.1.0-rt5-00350-gb2450b7e00be-dirty #26

Description The vulnerability is related to a slab-out-of-bounds issue in the handle rx uart function of the qcom-geni-serial driver. This occurs when the RX FIFO depth is updated after the probe, causing the RX UART handle code to read beyond the bounds of the port->rx fifo buffer. The issue can be observed in certain configurations with Qualcomm Bluetooth HCI UART devices and KASAN.

Technical details about exploitation include:

The qcom geni serial port setup function updates the RX FIFO depth (port->rx fifo depth) to match real device capabilities.
The RX UART handle code reads port->rx fifo depth number of words into the port->rx fifo buffer, thus exceeding the bounds.
Vulnerable function names include handle rx uart, qcom geni serial handle rx, and qcom geni serial isr.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploitability

Exploit

Impacts

Researchers

Vendors