CVE-2022-48643

What it actually does

Underflow of the nft_counters_enabled reference counter in nf_tables_addchain() error path when nft_basechain_init() sets NFT_CHAIN_BASE and subsequent nft_basechain_destroy() in nf_tables_chain_destroy() decrements it.

Why it matters to the business

Potential kernel instability or unexpected behavior when managing nftables chains under error conditions; organizations running affected kernels must apply updates promptly though no active exploitation is known.

How an attack unfolds

An attacker with ability to create and destroy nftables base chains triggers the error path in nf_tables_addchain() after nft_basechain_init(), causing the counter underflow; syzbot discovered via fuzzing but no public exploit or threat actor use reported.

How to fix it

Upgrade Linux kernel to a fixed version such as 5.10.146 or any stable tree commit 710e3f526bd23a0d33435dedc52c3144de284378 or later; rebuild and reboot systems with the patched kernel.

How to confirm the fix worked

Confirm kernel version is at or above the listed fixed releases; inspect netfilter/nftables code for the counter increment immediately after nft_basechain_init() return; run regression tests exercising nf_tables_addchain() error paths.

Typical attack path

1. Obtain local or container access to issue nftables netlink commands
2. Craft sequence that reaches nft_basechain_init() then fails in nf_tables_addchain()
3. Trigger nf_tables_chain_destroy() which incorrectly decrements nft_counters_enabled
4. Observe underflow effects on subsequent chain operations

How to detect it

Review kernel logs for nftables-related warnings or counter anomalies around chain creation failures; no public indicators of active exploitation exist.

What your security team should do

• Prioritize kernel updates on all systems using nftables
• Monitor for new kernel releases containing the referenced commit
• Limit untrusted local code execution until patched