CVE-2022-48809

What it actually does

Incorrect refcount handling during skb dst+metadata uncloning in the Linux kernel leaves a dst+metadata object with a permanent refcount of 2, preventing it from being freed when the skb is consumed and causing a memory leak.

Why it matters to the business

Linux systems may experience gradual memory exhaustion over time, leading to performance degradation or denial of service; the issue affects a widely used kernel component with high ecosystem prevalence across servers, embedded devices, and Android.

How an attack unfolds

A local attacker crafts network traffic or uses a process that triggers tun_dst_unclone on an skb, causing the kernel to allocate a new dst+metadata object that is never released; repeated triggering depletes memory resources without requiring elevated privileges beyond local access.

How to fix it

Upgrade the Linux kernel to a version containing commit 4ac84498fbe84a00e7aef185e2bb3e40ce71eca4 or later; apply the fix from the stable tree and rebuild or install the updated kernel package.

How to confirm the fix worked

Confirm the running kernel includes commit 4ac84498fbe84a00e7aef185e2bb3e40ce71eca4 via git log or uname; monitor for absence of repeated dst metadata allocations in memory profiling tools after applying the update.

Typical attack path

1. Obtain local access to a Linux system
2. Trigger code paths that invoke tun_dst_unclone on skbs carrying dst metadata
3. Repeat operations to allocate multiple leaked dst+metadata objects
4. Observe system memory consumption increase until resource limits are hit

How to detect it

Monitor kernel memory statistics and slab allocator usage for unexpected growth in dst-related objects; review system logs for repeated allocation patterns around network stack operations and correlate with process activity that manipulates skbs.

What your security team should do

• Prioritize kernel upgrades on all affected Linux distributions and devices within the next maintenance window
• Review systems for high sustained memory usage patterns that may indicate prior exposure
• Enable kernel memory accounting and leak detection tooling in development and production environments