CVE-2022-48800

What it actually does

Race condition in mm/vmscan.c causes kcompactd to spin without rescheduling on CONFIG_PREEMPT=n kernels when a migration task holds many isolated LRU pages, resulting in soft lockups and an unreclaimable node under memory pressure.

Why it matters to the business

Systems may experience prolonged CPU soft lockups, stalled memory compaction, and potential denial of service on memory-intensive workloads with no swap; high RAM servers are most affected.

How an attack unfolds

An attacker triggers sustained memory pressure and page migration (for example via cpuset migration or compaction) on a non-preemptible kernel build; the resulting deadlock between kcompactd and the migrating task prevents forward progress and produces lockups.

How to fix it

Upgrade the Linux kernel to a version containing commit 31e1b63bb3e9f5b3adc289c5580e53d4dcabf277 (or later equivalent) that removes the throttling deadlock; rebuild with CONFIG_PREEMPT=y where feasible as a defense-in-depth measure.

How to confirm the fix worked

Confirm kernel version contains the fix commit; reproduce the original soft-lockup scenario under memory pressure and verify kcompactd no longer spins indefinitely; monitor for absence of the described dmesg watchdog messages.

Typical attack path

1. Trigger memory pressure and node unreclaimability
2. Initiate page migration or cpuset migration work
3. Isolate large numbers of LRU pages without allowing reschedule
4. kcompactd enters tight loop waiting on completion that never occurs
5. Soft lockup watchdog fires and system becomes unresponsive

How to detect it

Search kernel logs for repeated soft lockup messages referencing kcompactd; inspect crash dumps or live traces showing tasks blocked in __drain_all_pages or migrate_pages while kcompactd is stuck; correlate with memory-pressure events and absence of file LRU pages.

What your security team should do

• Apply the upstream kernel fix immediately on all affected distributions
• Prioritize patching of high-RAM, swap-disabled production systems
• Enable CONFIG_PREEMPT=y on new kernel builds as additional hardening
• Monitor EPSS and threat intel for any rise in exploitation of this class of memory-management races