CVE-2022-40307

What it actually does

Race condition in the EFI capsule loader driver results in a use-after-free condition that can corrupt kernel memory structures.

Why it matters to the business

Linux systems may experience unexpected crashes or degraded stability when EFI firmware capsule updates are processed concurrently, leading to unplanned downtime and increased support effort.

How an attack unfolds

A local attacker with low privileges triggers concurrent operations against the capsule loader to win the race, freeing a kernel object while it is still referenced, which may allow memory corruption or denial of service.

How to fix it

Upgrade the Linux kernel to a version containing commit 9cb636b5f6a8cc6d1b50809ec8f8d33ae0c84c95 or later; apply the fix through the distribution's kernel package update mechanism.

How to confirm the fix worked

Confirm the running kernel contains commit 9cb636b5f6a8cc6d1b50809ec8f8d33ae0c84c95; recompile or reload the efi capsule module and verify absence of the vulnerable code path via source inspection or kernel symbol checks.

Typical attack path

1. Obtain local low-privileged access to a Linux system
2. Identify or trigger EFI capsule loading activity
3. Race concurrent open/release operations on the capsule device
4. Trigger the use-after-free to induce kernel panic or attempt further corruption

How to detect it

Review kernel logs for oops or panic messages referencing capsule-loader or efi capsule operations; examine audit logs for unusual device access patterns around firmware update events.

What your security team should do

• Prioritize kernel updates on all EFI-enabled Linux systems within standard patch windows
• Monitor vendor advisories for backported fixes in supported distribution kernels
• Restrict untrusted local accounts where possible to reduce attack surface