CVE-2022-1974

What it actually does

Use-after-free in Linux NFC core from race between kobject create and delete allows local privileged process to read kernel memory.

Why it matters to the business

Attackers with administrative network privileges on a Linux system could obtain sensitive kernel data, increasing risk of further attacks on servers, embedded devices, or cloud instances using the affected kernel.

How an attack unfolds

An attacker with CAP_NET_ADMIN triggers the race condition in NFC kobject handling to cause a use-after-free, then reads the freed memory to leak kernel addresses and structures.

How to fix it

Upgrade the Linux kernel to commit da5c0f119203ad9728920456a0f52a6d850c01cd or later; rebuild and reboot systems with the patched kernel; disable NFC if unused.

How to confirm the fix worked

Confirm kernel version contains commit da5c0f119203ad9728920456a0f52a6d850c01cd; attempt to reproduce the race with a local CAP_NET_ADMIN process and verify no leak occurs.

Typical attack path

1. Obtain local access and CAP_NET_ADMIN capability
2. Trigger NFC kobject creation and deletion race
3. Read kernel memory via the dangling reference
4. Extract addresses or data for further exploitation

How to detect it

Review kernel logs and audit records for unexpected NFC kobject operations or memory access patterns by processes holding CAP_NET_ADMIN; no public exploitation artifacts are known.

What your security team should do

• Prioritize patching systems that expose NFC or run with network admin privileges
• Apply the fixed commit da5c0f119203ad9728920456a0f52a6d850c01cd across all affected distributions
• Audit for unnecessary CAP_NET_ADMIN grants and remove where possible
• Monitor for new kernel releases containing the fix