CVE-2022-2978

What it actually does

Use-after-free in Linux kernel NILFS file system when security_inode_alloc fails followed by nilfs_mdt_destroy, allowing local crash or privilege escalation.

Why it matters to the business

Local attackers can crash affected systems or gain elevated privileges leading to full compromise; low exploit maturity but present in kernel code used across many distributions.

How an attack unfolds

A local user triggers security_inode_alloc failure then nilfs_mdt_destroy to exploit the use-after-free condition for crash or privilege escalation; listed threat actors reference related Linux kernel use-after-free techniques.

How to fix it

Upgrade nasm packages on Debian 10/11/12/13 to version 2.14-1 and wordpress/wordpress-develop to commit 908d401880b3cd42e419a43f01f005ff2466c631; apply kernel patches addressing NILFS use-after-free.

How to confirm the fix worked

Verify package versions match listed fixed releases; confirm kernel NILFS code no longer contains the described failure path in security_inode_alloc and nilfs_mdt_destroy.

Typical attack path

1. Obtain local user access on affected Linux system
2. Mount or interact with NILFS file system to trigger inode allocation path
3. Force security_inode_alloc failure condition
4. Invoke nilfs_mdt_destroy to trigger use-after-free
5. Leverage freed memory for privilege escalation or denial of service

How to detect it

Review kernel logs and audit records for NILFS inode allocation failures followed by unexpected crashes or privilege changes; correlate with listed threat actor patterns for Linux kernel use-after-free.

What your security team should do

• Prioritize kernel updates on systems using NILFS file system
• Monitor EPSS trend for any increase above current 0.0025
• Restrict local unprivileged access where possible until patched