CVE-2022-48649

What it actually does

Race condition in kmem_cache_destroy allows concurrent execution of scheduled work and RCU flag check, resulting in double invocation of kmem_cache_release and potential double-free of kernel slab cache objects.

Why it matters to the business

Linux kernel instability, crashes, or memory corruption on affected systems can cause service outages, data loss, or create conditions for further attacks; urgency is low given no known exploitation but high prevalence of Linux kernels requires timely patching of production workloads.

How an attack unfolds

An attacker with local code execution triggers kmem_cache_destroy under specific RCU and slub_debug timing windows, causing the scheduled release work to run before the cached flag check and freeing the same cache twice; no named threat actors or ransomware campaigns are associated.

How to fix it

Upgrade to Linux kernel 5.19.12 or later; apply commit c673c6ceac53fb2e631c9fbbd79957099a08927f in the stable tree; rebuild and reboot all affected systems.

How to confirm the fix worked

Confirm kernel version is at least 5.19.12; run slub_debug tests and KASAN-enabled kunit cases for kmem_cache_destroy to verify absence of use-after-free reports; check git log for the referenced commit.

Typical attack path

1. Obtain local execution on a Linux system running an affected kernel version
2. Trigger code paths that invoke kmem_cache_destroy with RCU-flagged caches under debug configurations
3. Exploit the window between mutex release and work execution to force double kmem_cache_release
4. Leverage resulting use-after-free or double-free for memory corruption or denial of service

How to detect it

Review kernel logs for KASAN use-after-free reports referencing kobject_del or kmem_cache_destroy; inspect dmesg and audit logs around kmem_cache operations for double-release indicators; no public exploit artifacts are known.

What your security team should do

• Prioritize patching of internet-facing and multi-tenant Linux hosts within standard change windows
• Monitor EPSS and KEV status for any future increase in exploit maturity
• Include kernel update in next maintenance cycle for all distributions still on pre-5.19.12 branches