CVE-2022-48639

What it actually does

Refcount leak in Linux kernel net/sched due to missing tfilter_put call when chain->tmplt_ops is non-null and differs from tp->ops in tc_new_tfilter.

Why it matters to the business

Gradual kernel memory exhaustion on systems performing frequent network traffic classification, leading to instability or denial of service in production Linux environments.

How an attack unfolds

An attacker repeatedly triggers tc_new_tfilter with template operations active on a chain, causing the reference count leak to accumulate without any compensating put operation until memory pressure forces failure.

How to fix it

Upgrade the Linux kernel to a version containing commit 903f7d322c17d8e306d766404b4604e81653902a or later stable releases that include the tfilter_put call.

How to confirm the fix worked

Verify the running kernel source contains the referenced commit or apply the patch and confirm tc_new_tfilter now calls tfilter_put when tmplt_ops conditions are met; retest filter creation paths.

Typical attack path

1. Obtain local or network access to a Linux system with traffic control filters enabled.
2. Craft and apply qdisc configurations that set chain->tmplt_ops but differ from the filter ops.
3. Invoke tc_new_tfilter repeatedly to trigger the unbalanced reference acquisition.
4. Observe progressive memory depletion without immediate crash or code execution.

How to detect it

Review kernel logs for repeated memory allocation warnings near net/sched code paths and correlate with tc filter creation events; examine slab or kmemleak reports for unreleased tfilter objects.

What your security team should do

• Prioritize kernel upgrades on all internet-facing and multi-tenant Linux hosts within the next maintenance window.
• Audit custom qdisc and filter configurations for tmplt_ops usage.
• Monitor memory usage trends on systems using advanced traffic control.
• Subscribe to stable kernel update feeds for future refcount-related fixes.