CVE-2022-1195

What it actually does

Use-after-free in Linux kernel hamradio drivers (mkiss/sixpack) allows a local user to trigger resource reclamation timing that leads to kernel crash or denial of service.

Why it matters to the business

Local users can crash affected systems, causing unplanned downtime and potential loss of availability on Linux hosts running hamradio networking support.

How an attack unfolds

An attacker with local user access creates and then detaches a mkiss or sixpack device, forcing the kernel to free structures while they are still referenced, resulting in a crash.

How to fix it

Update the Linux kernel to a version containing commit 0b9111922b1f399aba6ed1e1b8f2079c3da1aed8 or later; disable hamradio drivers if the functionality is unused.

How to confirm the fix worked

Verify the running kernel contains commit 0b9111922b1f399aba6ed1e1b8f2079c3da1aed8; attempt to attach and detach mkiss/sixpack devices under a non-root account and confirm no crash occurs.

Typical attack path

1. Obtain local user shell on target Linux system
2. Load or interact with hamradio mkiss or sixpack device interfaces
3. Detach the device to trigger early resource reclamation
4. Observe resulting kernel panic or denial of service

How to detect it

Review kernel logs (dmesg, /var/log/kern.log) for oops or panic entries referencing drivers/net/hamradio, mkiss, or sixpack around the time of unexpected reboots or service outages.

What your security team should do

• Apply the referenced kernel commit or distribution update immediately on systems exposing hamradio drivers
• Restrict local user access to device creation for hamradio interfaces via permissions or module blacklisting
• Monitor kernel crash logs for hamradio-related oops or use-after-free signatures