CVE-2022-48691

What it actually does

Failure to splice the hook list back on offload flags check error in nft_chain_parse_hook leaves allocated nft_netdev_hook objects unreferenced, producing a memory leak.

Why it matters to the business

Local users on Linux systems using nftables netdev hooks can gradually exhaust kernel memory, leading to denial of service or system instability; the issue affects the vast majority of Linux distributions and has been public for over two years.

How an attack unfolds

An attacker with local privileges sends a crafted NFNL_MSG_NEWCHAIN netlink message that triggers nft_chain_parse_netdev and nft_chain_parse_hook; when the subsequent offload flags verification fails, the allocated hook is never released, slowly depleting kernel memory.

How to fix it

Upgrade the Linux kernel to a version containing commit 910891a2a44cdc49efcc4fe7459c1085ba00d0f4 or later; rebuild and reboot with the patched kernel; where immediate patching is impossible, restrict unprivileged users from the CAP_NET_ADMIN capability required to manage nftables.

How to confirm the fix worked

Confirm the running kernel Git commit or version string contains 910891a2a44cdc49efcc4fe7459c1085ba00d0f4; attempt to reproduce the original syzkaller reproducer and verify no new unreferenced nft_netdev_hook objects appear in kmemleak or slabinfo.

Typical attack path

1. Obtain local shell or equivalent privileges on target Linux host
2. Craft malicious netlink batch containing nf_tables NEWCHAIN request with netdev hook and invalid offload flags
3. Invoke nfnetlink_rcv to reach nf_tables_newchain and nft_chain_parse_hook
4. Trigger the offload check failure path that omits hook list cleanup
5. Repeat to accumulate unreferenced nft_netdev_hook allocations until memory pressure occurs

How to detect it

Inspect kernel logs for repeated nft_netdev_hook_alloc allocations without matching releases; enable kmemleak and search for unreferenced objects whose backtrace matches nft_chain_parse_hook; correlate netlink audit records showing NFNL_MSG_NEWCHAIN operations that fail after hook allocation.

What your security team should do

• Apply the referenced kernel commit immediately on all systems that expose nftables netdev hook configuration to non-root users
• Audit nftables rulesets for netdev family chains and remove or restrict them until patches are deployed
• Monitor EPSS and KEV updates for any future increase in exploit activity