CVE-2022-4696

What it actually does

Use-after-free in Linux kernel io_uring IORING_OP_SPLICE path when IO_WQ_WORK_FILES flag is absent; io_splice can invoke get_uts which touches current->nsproxy without the expected reference, causing premature decrement and subsequent dangling pointer dereference.

Why it matters to the business

Local attackers on affected Linux systems can escalate privileges to root, fully compromise the host, and disrupt or take over workloads; the flaw has been public for over three years with public exploits available.

How an attack unfolds

An attacker with a local shell crafts an io_uring submission queue entry using IORING_OP_SPLICE against specific file descriptors that trigger get_uts on current->nsproxy; the missing reference increment leads to a use-after-free that is turned into arbitrary kernel read/write or code execution.

How to fix it

Upgrade the Linux kernel to version 5.10.160 or newer, or apply commit 9f4ad9e425a1d3b6a34617b8ea226d56a119a717 (or equivalent backports) and rebuild/reboot.

How to confirm the fix worked

Verify running kernel version is 5.10.160 or later; confirm the commit is present in the kernel source tree; run regression tests exercising io_uring splice operations on utsname-related file descriptors.

Typical attack path

1. Obtain local unprivileged shell on target Linux host
2. Load or compile io_uring splice PoC that omits IO_WQ_WORK_FILES on targeted files
3. Trigger the submission to cause nsproxy reference underflow
4. Exploit resulting UAF for kernel memory corruption or ROP
5. Escalate to root and install persistence or exfiltrate data

How to detect it

Review kernel logs (dmesg, journalctl) for oops or warnings referencing io_uring, splice, or nsproxy around the time of suspicious local activity; inspect audit logs for unusual io_uring syscalls from non-root users.

What your security team should do

• Immediately schedule kernel upgrades to 5.10.160+ across all fleets
• Restrict untrusted local code execution via seccomp or containers until patched
• Monitor for kernel oops/panic reports involving io_uring or nsproxy
• Prioritize systems with high EPSS or public exploit availability