CVE-2022-1204

What it actually does

Use-after-free in the Linux kernel AX.25 protocol handler triggered during user-initiated connection setup, resulting in local denial-of-service via kernel panic or crash.

Why it matters to the business

Systems running older Linux kernels with AX.25 support enabled can be crashed by any local user, causing unplanned downtime on affected amateur radio or embedded devices; low urgency given stable low EPSS and lack of KEV listing despite public exploit availability.

How an attack unfolds

A local attacker with low privileges opens an AX.25 socket and performs a connection sequence that leaves a dangling reference; the kernel later dereferences the freed object, triggering a crash. Public exploits exist but the flaw has not been observed in ransomware or named APT campaigns.

How to fix it

Upgrade the Linux kernel to the commit f443e374ae131c168a065ea1748feac6b2e76613 or later; disable the AX.25 protocol module if unused.

How to confirm the fix worked

Verify the running kernel contains commit f443e374ae131c168a065ea1748feac6b2e76613 via git log or uname; attempt AX.25 socket operations under a non-root account and confirm no crash occurs.

Typical attack path

1. Obtain local shell or user context on a Linux system with AX.25 enabled
2. Open an AF_AX25 socket and issue connect or bind operations
3. Trigger the use-after-free path in the protocol state machine
4. Observe kernel oops/panic resulting in system crash or reboot

How to detect it

Review kernel logs (dmesg, /var/log/kern.log) for AX.25 related use-after-free oops messages or panics around the time of reported instability; correlate with processes that opened AX.25 sockets.

• ax25.*use-after-free
• Unable to handle kernel paging request.*ax25
• general protection fault.*ax25_connect

What your security team should do

• Apply the referenced kernel commit or newer distribution package immediately on any system exposing AX.25
• Audit kernel configs for CONFIG_AX25 and remove the module if amateur radio functionality is not required
• Monitor EPSS and exploit maturity indicators for any future uptick despite current low scores