CVE-2022-48799

What it actually does

Unsafe list iteration over cgrp_cpuctx_list in perf_cgroup_switch allows concurrent removal of entries during cpu_ctx_sched_in / ctx_pinned_sched_in / merge_sched_in, resulting in list corruption.

Why it matters to the business

Kernel instability or crashes during performance monitoring and cgroup scheduling on Linux systems, increasing operational risk for workloads using perf and cgroups; low exploitability reduces immediate urgency despite widespread kernel deployment.

How an attack unfolds

An attacker triggers perf events attached to cgroups while perf_cgroup_switch iterates the list; a concurrent perf_cgroup_event_disable removes an entry, corrupting the list structure and potentially leading to memory corruption or denial of service.

How to fix it

Update the Linux kernel to a version containing commit 5d76ed4223403f90421782adb2f20a9ecbc93186 or later; apply the fix that replaces list_for_each_entry with list_for_each_entry_safe in perf_cgroup_switch.

How to confirm the fix worked

Verify the running kernel contains commit 5d76ed4223403f90421782adb2f20a9ecbc93186 via git log or uname output; confirm absence of list corruption warnings in dmesg under perf cgroup workloads.

Typical attack path

1. Attach perf events to cgroups
2. Trigger cgroup context switches via scheduling or migration
3. Concurrently disable events to force list removal during iteration
4. Observe or exploit resulting list corruption

How to detect it

Inspect kernel logs for list corruption or oops messages referencing perf_cgroup_switch or cgrp_cpuctx_list; review audit logs for unusual perf event creation and cgroup activity around crash times.

What your security team should do

• Prioritize kernel upgrades on systems using perf with cgroups
• Monitor for list corruption oops in kernel logs
• Restrict unprivileged perf access until patched