CVE-2022-0480

What it actually does

The flaw permits creation of an unbounded number of POSIX file locks in the kernel, bypassing memcg limits and exhausting host memory.

Why it matters to the business

Systems may become unresponsive or crash under sustained local workload, interrupting services and requiring restarts; widespread Linux deployments increase exposure across servers and containers.

How an attack unfolds

A local process repeatedly acquires POSIX file locks on files or inodes; because memcg accounting is absent, kernel memory structures grow until the system OOM-kills processes or panics.

How to fix it

Upgrade the Linux kernel to the commit 0f12156dff2862ac54235fc72703f18770769042 or later distribution packages that include the fix; enable memory cgroups v2 where possible and apply resource limits via systemd or container runtimes as a defense-in-depth measure.

How to confirm the fix worked

Verify the running kernel contains commit 0f12156dff2862ac54235fc72703f18770769042; test by attempting to acquire a large number of POSIX locks under a memory cgroup and confirm the operation is now limited or accounted.

Typical attack path

1. Obtain local user or container access on a vulnerable kernel
2. Open files or inodes and call fcntl(2) or flock(2) in a tight loop to acquire locks
3. Monitor memory usage until kernel slab or vmalloc regions are exhausted
4. Trigger OOM or system instability to achieve denial of service

How to detect it

Inspect kernel logs for repeated fcntl or locks.c messages, monitor /proc/locks growth and memory cgroup statistics for sudden spikes, and correlate with processes that have high file-descriptor counts.

What your security team should do

• Prioritize kernel updates on all internet-facing and multi-tenant systems within the next patching cycle
• Review and tighten memory cgroup limits for untrusted workloads and containers
• Monitor kernel logs for OOM killer activity correlated with high lock counts
• Track upstream stable kernel releases for backported fixes in supported distributions