CVE-2022-1205

What it actually does

NULL pointer dereference in Linux kernel AX.25 protocol handler during user-initiated connection causes kernel panic and system crash.

Why it matters to the business

Local users can trigger repeated system crashes leading to unplanned downtime and loss of availability on affected Linux systems; low prevalence reduces overall exposure but still requires attention on amateur radio or AX.25-enabled hosts.

How an attack unfolds

An authenticated local attacker opens a socket and initiates a connection using the AX.25 protocol in a manner that reaches the flawed code path, dereferencing a NULL pointer and forcing an immediate kernel oops and reboot.

How to fix it

Upgrade the Linux kernel to a version containing the AX.25 NULL pointer fix; apply the latest distribution security updates and reboot. Disable the AX.25 protocol modules if the functionality is unused.

How to confirm the fix worked

Verify the running kernel version is newer than the vulnerable release; attempt to load AX.25 modules and exercise socket operations in a test environment while monitoring for oops/panic; confirm no crash occurs.

Typical attack path

1. Obtain local shell access on target Linux system
2. Load or ensure AX.25 kernel modules are present
3. Craft and execute socket/connect sequence targeting AX.25
4. Trigger NULL dereference resulting in kernel panic

How to detect it

Review kernel logs (dmesg, /var/log/kern.log, journalctl) for oops/panic entries containing ax25, null pointer dereference, or amateur radio protocol stack frames around the time of unexpected reboots.

• Unable to handle kernel NULL pointer dereference
• ax25
• amateur radio

What your security team should do

• Apply kernel security updates within standard patch windows given low EPSS and absence from KEV
• Audit systems for AX.25 module usage and disable where unnecessary
• Monitor kernel logs for ax25-related oops entries as an ongoing detection measure