CVE-2022-47929

What it actually does

NULL pointer dereference in qdisc_graft function within net/sched/sch_api.c of the Linux kernel traffic control subsystem, triggered by crafted qdisc and class configurations, resulting in kernel panic and denial of service.

Why it matters to the business

Unprivileged local users can crash affected Linux systems, causing unplanned downtime, service interruptions, and potential data loss for workloads running on unpatched kernels; urgency is moderate given exploit availability but low EPSS and no KEV listing.

How an attack unfolds

An attacker with local unprivileged access crafts malicious traffic control configurations using tc qdisc and tc class commands to reach the vulnerable qdisc_graft path, dereferencing a NULL pointer and forcing a kernel crash; no widespread threat actor campaigns noted beyond generic kernel vulnerability references.

How to fix it

Upgrade the Linux kernel to version 6.1.6 or newer; apply commit 96398560f26aa07e8f2969d73c8197e6a6d10407 from the mainline repository; rebuild and deploy custom kernels or use distribution backports where available.

How to confirm the fix worked

Verify running kernel version is 6.1.6 or later; inspect git log for presence of commit 96398560f26aa07e8f2969d73c8197e6a6d10407 in the net/sched/sch_api.c file; test with non-malicious tc configurations to confirm stability.

Typical attack path

1. Gain local shell access as an unprivileged user
2. Prepare and apply crafted qdisc/class traffic control rules via tc commands
3. Trigger the dereference in sch_api.c leading to immediate kernel panic

How to detect it

Review audit logs and command history for invocations of tc qdisc or tc class by unprivileged users; inspect kernel ring buffer or syslog for NULL pointer dereference panics originating from net/sched/sch_api.c.

• qdisc_graft
• net/sched/sch_api.c
• NULL pointer dereference.*traffic control
• tc qdisc add.*class

What your security team should do

• Apply kernel updates to all systems before the next maintenance window
• Audit local user permissions and restrict tc command access via capabilities or SELinux/AppArmor policies
• Monitor kernel logs for oops/panic events referencing sch_api.c