CVE-2022-39188

What it actually does

Race condition between unmap_mapping_range and munmap in asm-generic/tlb.h allows a device driver to free a page while stale TLB entries remain, restricted to VM_PFNMAP VMAs and resulting in use-after-free conditions in the Linux kernel.

Why it matters to the business

Kernel instability or crashes on Linux systems using affected device drivers; low exploitability and 1506 days since disclosure reduce immediate operational risk, though unpatched kernels in device-heavy environments remain exposed.

How an attack unfolds

An attacker with local access crafts concurrent unmapping operations on VM_PFNMAP memory regions to trigger the race, freeing a page while TLB entries are still valid and causing subsequent access to freed memory.

How to fix it

Upgrade the Linux kernel to a version containing commit b67fbebd4cf980aecbcc750e1462128bffe8ae15 or later; rebuild and reboot with the patched kernel; apply vendor backports where available for supported distributions.

How to confirm the fix worked

Confirm kernel version is at or above the fixed commit; inspect include/asm-generic/tlb.h for the race-condition mitigation; run targeted stress tests exercising VM_PFNMAP unmapping under concurrent loads.

Typical attack path

1. Obtain local code execution on the target Linux system
2. Identify or create a process using VM_PFNMAP VMAs with a vulnerable device driver
3. Trigger concurrent munmap and unmap_mapping_range operations to win the race
4. Access the freed page via stale TLB entries to induce kernel panic or corruption

How to detect it

Review kernel logs for page-fault or TLB-related oops messages coinciding with device-driver activity; correlate with process munmap patterns on VM_PFNMAP regions; no public exploitation artifacts are known given None exploit maturity.

What your security team should do

• Prioritize kernel updates on systems with custom or high-privilege device drivers
• Monitor EPSS trend (currently low at 0.00243 with modest increase) and re-evaluate if exploit maturity changes
• Restrict untrusted local code execution on multi-user or container hosts until patched