CVE-2022-48819

What it actually does

Mixing sendpage() and sendmsg(MSG_ZEROCOPY) on the same TCP socket bypasses proper accounting for sk_forward_alloc, leaving the socket in an inconsistent state that triggers WARN_ON(sk_forward_alloc_get(sk)) during inet_sock_destruct().

Why it matters to the business

Linux-based servers and appliances may experience kernel warnings or subtle networking instability under load when applications combine splice and zerocopy operations, increasing operational risk for organizations running the affected kernel versions across Debian and Ubuntu distributions.

How an attack unfolds

An attacker with local or container access crafts a sequence of splice() and sendmsg(MSG_ZEROCOPY) calls on a TCP socket to trigger the accounting mismatch; the kernel emits a warning but continues, potentially allowing repeated triggering or follow-on resource manipulation.

How to fix it

Upgrade to a fixed kernel: Debian 11/12/13 users to 5.10.103-1 or 5.16.7-1 respectively; Ubuntu 20.04/22.04 users to the listed 5.15.0 or 5.4.0 packages (e.g., linux-aws-5.15 to 5.15.0-1014.18~20.04.1). Reboot after installation and verify the running kernel version.

How to confirm the fix worked

Confirm the running kernel version matches or exceeds a listed fixed package; monitor dmesg for absence of the sk_forward_alloc_get warning after exercising mixed splice/zerocopy workloads.

Typical attack path

1. Obtain local execution context on an affected Linux system
2. Open a TCP socket and perform a series of splice() operations from a pipe
3. Follow with sendmsg() calls using MSG_ZEROCOPY on the same socket
4. Trigger socket teardown to hit inet_sock_destruct() and the warning

How to detect it

Search kernel logs (dmesg, /var/log/kern.log, journalctl) for the exact warning string "WARN_ON(sk_forward_alloc_get(sk))" or references to inet_sock_destruct combined with TCP zerocopy activity; correlate with process audit logs showing splice and sendmsg syscalls on the same socket.

• WARN_ON(sk_forward_alloc_get(sk))
• inet_sock_destruct
• tcp_downgrade_zcopy_pure

What your security team should do

• Prioritize patching internet-facing or high-value Linux hosts within the CISA-style remediation window even though not KEV-listed
• Inventory workloads that use splice() + MSG_ZEROCOPY patterns and test the updated kernels
• Add kernel version checks to vulnerability scanning and asset management pipelines