CVE-2022-48642

What it actually does

A percpu memory leak occurs in nf_tables_addchain() when nft_chain_offload_priority() returns an error after the basechain priority mapping change, preventing proper cleanup of allocated chain stats memory.

Why it matters to the business

Gradual memory exhaustion on Linux systems using netfilter can degrade performance, trigger OOM conditions, or require unplanned restarts, impacting availability of network services and increasing operational overhead across widespread kernel deployments.

How an attack unfolds

An attacker with local or privileged access to configure nftables chains triggers repeated error paths in priority offload mapping to accumulate leaked percpu allocations without triggering alerts, slowly consuming memory until system impact occurs.

How to fix it

Apply the kernel fix from commit b043a525a3f5520abb676a7cd8f6328fdf959e88 or upgrade to a stable Linux kernel release containing this commit; rebuild and reboot affected systems.

How to confirm the fix worked

Verify the presence of commit b043a525a3f5520abb676a7cd8f6328fdf959e88 in the running kernel source; monitor percpu memory counters and nftables chain addition rates post-upgrade to confirm leak cessation.

Typical attack path

1. Obtain ability to manage nftables chains on a vulnerable kernel
2. Craft chain configurations that cause nft_chain_offload_priority() to fail
3. Repeatedly invoke nftables_addchain operations to trigger the leak
4. Monitor for gradual percpu memory growth leading to resource pressure

How to detect it

Review system logs for repeated nftables chain additions coinciding with unexplained percpu or slab memory growth; examine kernel memory statistics via standard proc interfaces for sustained increases tied to netfilter activity.

What your security team should do

• Prioritize kernel updates to include the referenced fix commit across all affected Linux distributions
• Audit nftables usage and restrict chain management privileges where possible
• Implement memory usage monitoring and alerting for netfilter-enabled hosts