CVE-2022-33981

What it actually does

Concurrency use-after-free in drivers/block/floppy.c after deallocating raw_cmd inside raw_cmd_ioctl, allowing a local process to trigger a kernel crash.

Why it matters to the business

Systems running affected Linux kernels with floppy driver support enabled can experience unexpected crashes and loss of availability; the issue is local-only and carries low exploitation likelihood.

How an attack unfolds

A local attacker with access to the floppy device node issues crafted ioctl calls that race with deallocation of the raw_cmd structure, resulting in a use-after-free that the kernel cannot recover from and panics.

How to fix it

Upgrade the Linux kernel to a version containing commit 233087ca063686964a53c829d547c7571e3f67bf (or any release after 5.17.6) and rebuild with the floppy driver if required; disable the floppy module via modprobe.blacklist if the hardware is not present.

How to confirm the fix worked

Verify the running kernel contains the referenced commit or is version 5.17.6 or newer; attempt to load the floppy module and exercise raw_cmd ioctls under stress to confirm absence of the crash.

Typical attack path

1. Obtain local shell on target Linux system
2. Locate or create a /dev/fd* or floppy device node
3. Issue repeated raw_cmd_ioctl calls in a timing-sensitive loop
4. Trigger the use-after-free and force a kernel panic

How to detect it

Review kernel logs for oops or panic messages mentioning floppy.c, raw_cmd_ioctl, or use-after-free in the block layer; correlate with processes that opened floppy device nodes shortly before the crash.

What your security team should do

• Apply the kernel update containing commit 233087ca063686964a53c829d547c7571e3f67bf as soon as possible on all systems that include the floppy driver
• Blacklist the floppy module on systems without physical floppy hardware
• Monitor for kernel oops/panic reports referencing floppy.c or raw_cmd_ioctl