CVE-2022-48699

What it actually does

Improper dentry reference counting in update_sched_domain_debugfs causes a memory leak when debugfs_remove(debugfs_lookup()) is called repeatedly.

Why it matters to the business

Prolonged operation under CPU hotplug or scheduler stress can exhaust kernel memory, leading to system instability, degraded performance, or forced reboots on affected Linux systems.

How an attack unfolds

An attacker with local access triggers repeated scheduler domain updates via CPU hotplug events or stress workloads that invoke the leaky debugfs path, gradually consuming memory until the system becomes unusable.

How to fix it

Upgrade the Linux kernel to a version containing commit 26e9a1ded8923510e5529fbb28390b22228700c2 which replaces the leaky pattern with debugfs_lookup_and_remove().

How to confirm the fix worked

Confirm the running kernel contains commit 26e9a1ded8923510e5529fbb28390b22228700c2 and verify no dentry leaks occur under hotplug stress testing.

Typical attack path

1. Obtain local access to a Linux system running an affected kernel
2. Induce repeated CPU hotplug or scheduler domain changes
3. Trigger the debugfs dentry leak in update_sched_domain_debugfs
4. Continue until kernel memory is exhausted

How to detect it

Review kernel logs for repeated debugfs dentry operations under hotplug events and monitor memory usage trends; correlate with scheduler domain update activity.

What your security team should do

• Apply the kernel update containing the referenced commit as soon as possible
• Prioritize systems exposed to frequent CPU hotplug or high scheduler activity
• Monitor for memory pressure indicators on production kernels until patched