CVE-2022-1198

What it actually does

Use-after-free in drivers/net/hamradio/6pack.c allows a local user-space process simulating an AX.25 device via the 6pack driver to reference freed kernel memory, resulting in a kernel panic.

Why it matters to the business

Local denial-of-service that can abruptly halt systems running affected kernels, interrupting services and requiring manual restarts or reboots.

How an attack unfolds

An attacker with local shell access crafts a user-space program that registers a fake AX.25 device through the 6pack ham-radio driver; the resulting sequence of operations triggers the use-after-free, crashing the kernel.

How to fix it

Upgrade the kernel to the commit efe4186e6a1b54bf38b9e05450d43b0da1fd7739 or later; rebuild and reboot with the patched kernel.

How to confirm the fix worked

Verify the running kernel contains commit efe4186e6a1b54bf38b9e05450d43b0da1fd7739 (via git log or kernel version string) and confirm the 6pack driver no longer panics under the original reproducer.

Typical attack path

1. Obtain a local user account on the target Linux system
2. Compile and run a program that opens and configures the 6pack driver to emulate an AX.25 device
3. Trigger the specific packet or device teardown sequence that exercises the freed memory reference
4. Observe or force a kernel oops/panic

How to detect it

Search kernel logs (dmesg, /var/log/kern.log, journalctl) for oops or panic messages mentioning 6pack, ax25, or use-after-free in drivers/net/hamradio; correlate with processes that opened /dev/ax25 or similar ham-radio interfaces.

What your security team should do

• Apply the referenced kernel commit immediately on all affected systems
• Restrict unprivileged local access where possible until patches are deployed
• Monitor for kernel panics referencing 6pack or AX.25