CVE-2022-48659

What it actually does

A missing error check on kmalloc failure in create_unique_id allows a BUG_ON assertion to trigger a kernel panic instead of returning an error code when creating SLUB caches for certain filesystems.

Why it matters to the business

Systems running affected kernels may experience unexpected crashes during filesystem mount operations under memory pressure, leading to downtime and potential data loss for workloads using F2FS.

How an attack unfolds

An attacker with local access triggers repeated mount attempts of an F2FS filesystem while the system is under memory pressure, causing the unhandled kmalloc failure path during xattr cache initialization to invoke the BUG handler and panic the kernel.

How to fix it

Upgrade to a Linux kernel containing commit e9219fa63c5c25804af82c7aa54d1ec770ebe457 or later; apply the fix that properly returns errno on kmalloc failure instead of calling BUG_ON.

How to confirm the fix worked

Confirm the running kernel includes the referenced commit or a backported equivalent; attempt F2FS mounts under simulated memory pressure to verify no panic occurs and errors are handled gracefully.

Typical attack path

1. Obtain local user access on a Linux system using an affected kernel
2. Induce memory pressure on the target system
3. Attempt to mount an F2FS filesystem
4. Trigger the kmalloc failure in create_unique_id during xattr cache setup
5. Cause kernel BUG and system panic

How to detect it

Review kernel logs for BUG reports at mm/slub.c during f2fs_fill_super or sysfs_slab_add; look for Oops entries tied to kmem_cache_create failures on F2FS mounts.

What your security team should do

• Prioritize kernel updates on all systems using F2FS filesystems
• Monitor for kernel oops and BUG reports referencing mm/slub.c during mount operations
• Apply the fix from commit e9219fa63c5c25804af82c7aa54d1ec770ebe457 where possible