CVE-2022-28388

What it actually does

Double-free vulnerability in usb_8dev_start_xmit allows a local user to trigger repeated free operations on the same kernel memory object in the USB CAN driver.

Why it matters to the business

Systems using affected USB CAN hardware may experience kernel crashes or denial of service; the issue affects a narrow set of devices and has seen no widespread exploitation in over four years.

How an attack unfolds

An attacker with local access sends crafted CAN frames through the usb_8dev USB device, causing the driver to free the same buffer twice and corrupt kernel memory structures.

How to fix it

Update the Linux kernel to a version containing commit 3d3925ff6433f98992685a9679613a2cc97f3ce2 or later; disable the usb_8dev driver if the hardware is not required.

How to confirm the fix worked

Verify the running kernel contains commit 3d3925ff6433f98992685a9679613a2cc97f3ce2; confirm the usb_8dev module is absent or updated; test with synthetic CAN traffic if hardware is present.

Typical attack path

1. Obtain local shell or user access on a Linux system with the vulnerable usb_8dev driver loaded
2. Attach or simulate a usb_8dev USB CAN device
3. Transmit specially formed CAN messages that exercise the start_xmit path
4. Trigger the double-free and induce kernel panic or memory corruption

How to detect it

Review kernel logs for usb_8dev double-free or slab corruption messages; correlate with USB device attach events; no public exploit artifacts are known.

What your security team should do

• Prioritize kernel updates on systems that expose USB CAN devices to untrusted local users
• Remove or blacklist the usb_8dev module on hosts without CAN hardware
• Monitor kernel oops/panic logs for usb_8dev-related crashes as a general hygiene measure