CVE-2022-0286

What it actually does

Null pointer dereference in bond_ipsec_add_sa() within the Linux kernel bonding driver allows a local process to trigger a kernel crash resulting in denial of service.

Why it matters to the business

Systems using Linux kernel bonding with IPsec may experience unexpected crashes and service outages; the issue has been public for over four years with publicly available exploit code but low observed exploitation rates.

How an attack unfolds

A local attacker with low privileges invokes the IPsec security association addition path in a bonded interface configuration, causing the kernel to dereference a null pointer and panic the system.

How to fix it

Upgrade the Linux kernel to a version containing commit 105cd17a866017b45f3c45901b394c711c97bf40 or later; apply vendor-supplied updates for all affected distributions.

How to confirm the fix worked

Verify the running kernel contains commit 105cd17a866017b45f3c45901b394c711c97bf40 or a backport; reproduce the bond IPsec SA addition under load to confirm stability.

Typical attack path

1. Obtain a local shell or process on an affected Linux system
2. Configure or interact with a network bond that has IPsec enabled
3. Trigger bond_ipsec_add_sa() via userspace IPsec tooling or direct socket calls
4. Cause kernel null dereference and system crash

How to detect it

Review kernel logs (dmesg, /var/log/kern.log, journalctl) for null pointer dereference or oops entries referencing bond_ipsec_add_sa; correlate with IPsec or bonding configuration changes.

• bond_ipsec_add_sa
• NULL pointer dereference in bonding driver
• kernel panic during IPsec SA addition on bond interface

What your security team should do

• Apply the kernel fix immediately on systems using bonding with IPsec
• Restrict local user access on high-value systems until patched
• Monitor kernel logs for bonding-related oops and panics as a temporary detection measure