CVE-2022-2938

What it actually does

Use-after-free in the Linux kernel PSI implementation leading to memory corruption, system crash, or potential privilege escalation when the feature is enabled.

Why it matters to the business

Local attackers can crash Linux systems or attempt to gain elevated access; the vulnerability affects a wide range of distributions but requires the non-default PSI feature to be active, increasing operational risk for servers and endpoints running vulnerable kernels.

How an attack unfolds

An attacker with local access enables PSI accounting, crafts input to trigger the use-after-free condition in the kernel's pressure stall tracking, and leverages the resulting memory corruption for denial of service or further exploitation.

How to fix it

Update the Linux kernel to a version containing commit a06247c6804f1a7c86a2e5398a4c1f1db1471848 or later; apply vendor-supplied kernel packages that backport the fix.

How to confirm the fix worked

Verify the running kernel contains commit a06247c6804f1a7c86a2e5398a4c1f1db1471848 by checking git log or kernel version strings; test PSI functionality post-upgrade to confirm stability.

Typical attack path

1. Obtain local user access to a Linux system
2. Enable Pressure Stall Information accounting via kernel interfaces
3. Trigger the use-after-free condition through crafted PSI operations
4. Exploit resulting memory corruption for crash or privilege escalation

How to detect it

Review kernel logs for PSI-related oops or panic messages; look for unexpected system crashes coinciding with PSI enablement in audit or system logs.

What your security team should do

• Prioritize kernel updates on all Linux systems where PSI may be enabled
• Disable PSI via kernel boot parameters if the feature is not required
• Monitor for new kernel releases and schedule patching within standard maintenance windows
• Review local access controls to limit untrusted user accounts