CVE-2022-3104

What it actually does

Missing validation of kmalloc() return value in lkdtm_ARRAY_BOUNDS causes null pointer dereference when allocation fails.

Why it matters to the business

Systems may experience unexpected crashes or denial of service, disrupting operations on affected Linux deployments; low exploitability limits widespread risk but still requires patching for stability.

How an attack unfolds

An attacker with local access loads the lkdtm test module and triggers ARRAY_BOUNDS to force a failed kmalloc followed by immediate use of the null result, resulting in a kernel panic.

How to fix it

Upgrade affected Linux kernel packages to a version containing the kmalloc return-value check; apply vendor updates promptly given the published date and EPSS trend.

How to confirm the fix worked

Confirm kernel version is newer than 5.16-rc6 and inspect drivers/misc/lkdtm/bugs.c for explicit kmalloc NULL checks; run lkdtm ARRAY_BOUNDS under memory pressure to verify no crash occurs.

Typical attack path

1. Gain local user access on a vulnerable system
2. Load or invoke the lkdtm module
3. Execute the ARRAY_BOUNDS test case
4. Trigger null pointer dereference to induce kernel panic

How to detect it

Inspect kernel logs for oops or panic entries referencing lkdtm or bugs.c around the time of crashes; search for module load events involving lkdtm.

What your security team should do

• Prioritize kernel updates on all production systems within standard maintenance windows
• Monitor EPSS score for any increase indicating rising exploit interest
• Review local access controls to reduce attack surface for kernel test modules