CVE-2022-1280

What it actually does

Use-after-free in drm_lease_held caused by a race condition allows a local attacker to read kernel memory or trigger a kernel crash.

Why it matters to the business

Local users on affected Linux systems can cause system crashes that disrupt workloads or leak kernel memory that may contain sensitive data; widespread impact on servers and desktops running vulnerable kernels.

How an attack unfolds

An attacker with local access crafts concurrent operations on DRM leases to trigger the race window, dereferences the freed object, and either reads kernel data or induces a panic.

How to fix it

Upgrade the Linux kernel to a version containing the fix for the race condition in drm_lease_held; apply vendor backports for Red Hat Enterprise Linux and rebuild custom kernels with the patch.

How to confirm the fix worked

Verify the running kernel version is newer than the vulnerable release and confirm the drm_lease.c patch is present; recompile test modules that exercise DRM leases to ensure no crash occurs.

Typical attack path

1. Obtain a local shell on a vulnerable system
2. Trigger concurrent DRM lease creation and release operations
3. Trigger the use-after-free to read kernel memory or crash the kernel

How to detect it

Search kernel logs and crash dumps for references to drm_lease_held, use-after-free warnings, and DRM-related oops messages; correlate with local user activity around the time of the event.

• drm_lease_held
• use-after-free in drivers/gpu/drm/drm_lease.c
• kernel oops.*drm_lease

What your security team should do

• Prioritize kernel updates on multi-user and internet-facing Linux systems
• Restrict local user accounts and limit access to graphics devices where possible
• Monitor kernel logs for oops and use-after-free warnings related to drm_lease