CVE-2022-48816

What it actually does

Race condition allows ->sock to be set to NULL during a sysfs read on an RPC transport when ->recv_mutex is not held, triggering a NULL dereference and kernel oops.

Why it matters to the business

Local users or processes can trigger a kernel crash, causing denial of service on affected Linux systems and potential disruption of services that rely on NFS or other RPC-based networking.

How an attack unfolds

An attacker with local access performs repeated sysfs reads against SUNRPC transport objects while concurrently triggering socket state changes; the missing mutex allows the pointer to become NULL between checks and dereference, resulting in an oops.

How to fix it

Update the Linux kernel to a version containing commit f40ddce88593482919761f74910f42f4b84c004b or later; rebuild and reboot with the patched kernel. Where immediate patching is not possible, restrict unprivileged local access to sysfs RPC transport files via mount options or LSM policy.

How to confirm the fix worked

Verify the running kernel contains commit f40ddce88593482919761f74910f42f4b84c004b or a backport; confirm the mutex acquisition now precedes the sock pointer check in the sysfs read path by inspecting the source or testing under concurrent load.

Typical attack path

1. Obtain local access on a system running an affected kernel
2. Locate and open sysfs files exposing SUNRPC transport state
3. Trigger concurrent socket or transport state changes from another process or thread
4. Cause NULL dereference during the unprotected read, producing a kernel oops

How to detect it

Review kernel logs for oops or panic entries referencing SUNRPC sysfs read paths or xprt_sock; correlate with unusual sysfs access patterns from unprivileged processes.

What your security team should do

• Prioritize patching kernel packages on all systems exposing sysfs to unprivileged users
• Apply the update containing f40ddce88593482919761f74910f42f4b84c004b within normal change windows given low EPSS and no KEV listing
• Harden local access controls around /sys/class/sunrpc/ until patches are deployed