CVE-2022-3630

What it actually does

The flaw causes a memory leak in the Linux kernel's fscache cookie handling within the IPsec component, where allocated memory is not properly released after use, resulting in gradual kernel memory exhaustion.

Why it matters to the business

Over time the leak can degrade system performance or trigger crashes on affected Linux systems, reducing availability of services that rely on IPsec and increasing operational overhead for restarts or monitoring.

How an attack unfolds

A local attacker with low privileges repeatedly exercises IPsec-related fscache operations to trigger the leak path in fs/fscache/cookie.c, accumulating unreleased memory until the system becomes unstable or crashes.

How to fix it

Apply the upstream kernel patch referenced by VDB-211931 or upgrade to a maintained Linux kernel release that resolves the cookie memory leak in fs/fscache/cookie.c; rebuild and reboot with the fixed kernel, then verify the change via kernel version and memory-leak testing.

How to confirm the fix worked

After patching, monitor kernel memory statistics under sustained IPsec load to confirm stable usage; review commit logs for the fscache cookie fix and run regression tests that exercise IPsec cookie paths.

Typical attack path

1. Obtain local user access on a Linux system running an affected kernel
2. Configure or interact with IPsec in a manner that exercises fscache cookie creation and destruction
3. Repeat the triggering operations to accelerate memory consumption
4. Observe or induce denial-of-service conditions from kernel memory pressure

How to detect it

Review kernel logs and memory accounting tools for sustained growth in fscache or IPsec related allocations without corresponding frees; correlate with IPsec configuration changes or connection events.

What your security team should do

• Prioritize kernel updates on systems that use IPsec
• Implement memory usage monitoring and alerting for kernel processes
• Restrict local access where possible to reduce attack surface
• Track EPSS trend and re-evaluate if exploit maturity increases