CVE-2022-3649

What it actually does

Use-after-free condition in nilfs_new_inode caused by improper handling of inode objects during allocation in the NILFS2 filesystem, allowing memory reuse after free.

Why it matters to the business

Local attackers on affected Linux systems may achieve elevated privileges or cause kernel instability, potentially disrupting operations on servers or devices using NILFS2; low exploit maturity reduces immediate risk but patch urgency remains for long-term exposure.

How an attack unfolds

An attacker with local access crafts inputs to trigger inode creation in NILFS2 while racing with memory management operations, freeing the object and then reallocating the memory for malicious control, leading to arbitrary code execution or denial of service.

How to fix it

Update the Linux kernel to include the fix for nilfs_new_inode; for wordpress/wordpress-develop (GIT) apply commit 2bb5679d666474d024352fa53f07344affef7e69 or later equivalent upstream kernel patch.

How to confirm the fix worked

Verify kernel version or source tree contains the referenced commit; attempt reproduction of inode operations under memory pressure to confirm absence of use-after-free behavior via kernel debugging tools.

Typical attack path

1. Obtain local user access on target Linux system
2. Mount or interact with a NILFS2 filesystem
3. Trigger repeated inode allocation/deallocation sequences via crafted operations
4. Exploit the freed memory reference to corrupt kernel structures
5. Escalate privileges or crash the kernel

How to detect it

Review kernel logs for NILFS2 inode allocation errors or oops messages around use-after-free patterns; correlate with local process activity on systems running unpatched kernels.

What your security team should do

• Prioritize kernel updates on all systems exposing NILFS2 filesystems within standard change windows
• Monitor EPSS trend and revisit if exploit code emerges
• Restrict local user access on multi-tenant systems until patched