CVE-2022-28389

What it actually does

Double-free condition in mcba_usb_start_xmit within the Linux kernel CAN USB driver resulting in memory corruption.

Why it matters to the business

Local denial-of-service risk on Linux systems using the affected USB CAN adapter, with potential for broader system instability in environments that rely on these devices.

How an attack unfolds

An attacker with local access loads or triggers the mcba_usb driver and supplies crafted input that causes the same memory buffer to be freed twice, leading to corruption that may crash the kernel.

How to fix it

Update the Linux kernel to a version containing commit 04c9b00ba83594a29813d6b1fb8fdc93a3915174 or later; rebuild and reboot with the patched kernel. Where immediate patching is not feasible, restrict untrusted local accounts and disable the mcba_usb module if the hardware is not required.

How to confirm the fix worked

Verify the running kernel contains commit 04c9b00ba83594a29813d6b1fb8fdc93a3915174 or a backport; confirm the vulnerable function no longer performs a second kfree on the same object by code review or by exercising the driver under test conditions without a crash.

Typical attack path

1. Obtain local user access on a Linux system exposing the mcba_usb driver
2. Trigger or enumerate the USB CAN device to reach mcba_usb_start_xmit
3. Supply malformed CAN frames or USB traffic that exercises the double-free path
4. Observe resulting kernel memory corruption or panic

How to detect it

Review kernel logs (dmesg, /var/log/kern.log) for oops/panic messages containing mcba_usb or double-free indicators; correlate with USB device attach events around the time of any crashes.

What your security team should do

• Apply the kernel commit fix at the earliest maintenance window
• Audit systems for presence of the mcba_usb driver and remove unnecessary USB CAN hardware
• Monitor kernel logs for oops or panic entries referencing mcba_usb
• Limit local privileged access until patches are deployed