CVE-2022-3543

What it actually does

The flaw triggers a memory leak in unix_sock_destructor and unix_release_sock within net/unix/af_unix.c when BPF is involved, allowing repeated allocation without corresponding deallocation.

Why it matters to the business

Over time the leak can exhaust kernel memory on Linux systems, leading to degraded performance, service disruption, or system instability; the issue affects a widely used operating system component with broad downstream impact.

How an attack unfolds

An attacker with local access crafts input that repeatedly exercises the affected Unix socket release path under BPF, gradually consuming memory until the system becomes unresponsive.

How to fix it

Upgrade the Linux kernel to the fixed commit 830b3c68c1fb1e9176028d02ef86f3cf76aa2476 or apply a vendor-supplied backport; rebuild and reboot with the patched kernel.

How to confirm the fix worked

Confirm the running kernel contains commit 830b3c68c1fb1e9176028d02ef86f3cf76aa2476; inspect memory usage patterns before and after patch application under load that exercises Unix sockets and BPF.

Typical attack path

1. Obtain local user access on a vulnerable Linux kernel
2. Trigger repeated Unix socket creation and release operations involving BPF
3. Monitor or accelerate memory consumption to induce resource exhaustion

How to detect it

Review system logs and performance counters for sustained kernel memory growth correlated with Unix socket or BPF activity; examine dmesg or slabinfo for increasing allocations in af_unix structures.

What your security team should do

• Prioritize kernel updates on all Linux hosts within the next maintenance window
• Monitor kernel memory statistics for unexplained growth on systems running older kernels
• Apply defense-in-depth by restricting untrusted local code execution where feasible