CVE-2022-48741

What it actually does

NULL pointer dereference in overlayfs copy-up warning path leading to kernel panic or crash.

Why it matters to the business

Unexpected system crashes on Linux kernels using overlay filesystems, causing downtime and potential data loss during file operations; low exploit likelihood reduces immediate urgency despite widespread kernel use.

How an attack unfolds

An attacker with local access triggers overlayfs copy-up operations under conditions that hit the uninitialized pointer in the warning code path, dereferencing NULL and crashing the kernel.

How to fix it

Upgrade Linux kernel to version 5.15.20 or later, or apply commit e6b678c1a3673de6a5d2f4e22bb725a086a0701a in affected stable trees.

How to confirm the fix worked

Verify running kernel version is at or above the fixed release; test overlayfs copy-up operations to confirm no crash occurs.

Typical attack path

1. Obtain local access to a vulnerable Linux system
2. Perform file operations that trigger overlayfs copy-up
3. Trigger the warning condition to reach the dereference
4. Cause kernel panic and system instability

How to detect it

Review kernel logs for NULL pointer dereference oops in overlayfs copy-up paths; no widespread exploitation indicators reported.

What your security team should do

• Prioritize kernel upgrades on all systems using overlayfs
• Monitor for kernel oops or panic logs related to overlayfs
• Apply updates within standard patch cycles given low EPSS