CVE-2022-3586

What it actually does

Use-after-free in the sch_sfb qdisc enqueue path where the SKB control block is dereferenced after the buffer has already been enqueued and freed into a child qdisc, allowing a local process to trigger a kernel crash.

Why it matters to the business

Local users on affected Linux systems can intentionally crash the host, causing denial of service and potential loss of availability for any workloads running on that machine; the large number of downstream Linux distributions increases the scope of exposure.

How an attack unfolds

An attacker with local unprivileged access configures a Stochastic Fair Blue (sch_sfb) qdisc hierarchy, enqueues a socket buffer, and then re-uses the already-freed SKB control-block field to trigger the use-after-free and panic the kernel.

How to fix it

Update the Linux kernel to a version containing commit 9efd23297cca or later; rebuild and deploy the fixed kernel across all affected hosts; reboot systems after installation.

How to confirm the fix worked

Confirm the running kernel contains commit 9efd23297cca or a back-port that removes the post-free SKB cb access in sch_sfb; run kernel selftests for qdisc enqueue paths or attempt local reproduction to verify the crash is no longer possible.

Typical attack path

1. Gain local shell access as an unprivileged user
2. Create a qdisc hierarchy that includes sch_sfb as parent and a child qdisc
3. Send or enqueue packets that exercise the sch_sfb enqueue routine
4. Trigger the double reference to the freed SKB cb field
5. Cause kernel panic and system reboot or hang

How to detect it

Review kernel logs for sch_sfb related oops or use-after-free stack traces; examine auditd or syslog entries showing creation of sch_sfb qdiscs by non-root users; look for repeated local crashes on systems running older kernels.

What your security team should do

• Prioritize patching any internet-facing or multi-tenant Linux hosts within the published remediation window
• Inventory all distributions and kernel versions in the environment and map them to the fixed commit
• Restrict unprivileged users from creating custom qdisc hierarchies where feasible until patches are applied