CVE-2022-3202

What it actually does

NULL pointer dereference in diFree within fs/jfs/inode.c causes kernel crash or disclosure of internal kernel memory structures when triggered by local unprivileged code on systems using the Journaled File System.

Why it matters to the business

Local users can force system reboots or obtain kernel memory contents on Linux deployments that rely on JFS, resulting in service outages and potential exposure of sensitive kernel data.

How an attack unfolds

An attacker with local access crafts operations that invoke diFree on a JFS inode, dereferencing a NULL pointer to either panic the kernel or read adjacent kernel structures; the low EPSS and absence from KEV indicate limited observed in-the-wild use despite the long-public commit fix.

How to fix it

Update the Linux kernel to commit a53046291020ec41e09181396c1e829287b48d47 or any later mainline release that contains the fix; rebuild and reboot with the patched kernel on all affected systems.

How to confirm the fix worked

Confirm the running kernel contains commit a53046291020ec41e09181396c1e829287b48d47 via git log or version string; attempt to reproduce the NULL dereference in a controlled JFS environment and verify the kernel no longer panics.

Typical attack path

1. Obtain local shell on target Linux system
2. Create or access a JFS-formatted volume
3. Trigger inode deallocation path that reaches diFree with a NULL pointer
4. Observe kernel panic or harvest leaked memory contents

How to detect it

Search kernel logs for JFS-related oops or NULL pointer dereference messages originating from fs/jfs/inode.c; correlate with process activity that performs heavy inode allocation and deallocation on JFS volumes.

What your security team should do

• Prioritize patching all systems that mount JFS file systems within the next maintenance window
• Audit kernel configurations to disable JFS if the file system is not required
• Monitor EPSS and threat actor reports for any future increase in exploitation activity