CVE-2022-48911

What it actually does

Use-after-free in netfilter nf_queue when sock_hold is called without verifying sk_refcnt > 0, allowing a freed socket to be dereferenced on packet queuing failure.

Why it matters to the business

Kernel memory corruption on affected Linux and Android systems can lead to crashes, denial of service, or potential code execution, disrupting network services and requiring urgent patching across large device fleets despite low observed exploitation rates.

How an attack unfolds

An attacker sends specially crafted network traffic that triggers nf_queue processing; on error paths the code may dereference a socket whose reference count has already reached zero, resulting in memory corruption. No widespread exploitation by named threat actors has been observed despite mentions of generic Linux kernel campaigns.

How to fix it

Update to Linux kernel commit 21b27b2baa27423286e9b8d3f0b194d587083d95 or later stable releases; for Android apply the libexif fixes released in platform versions 10 and 11 as of 2022-02-01. Reboot after patching and verify with kernel version checks.

How to confirm the fix worked

Confirm kernel builds contain commit 21b27b2baa27423286e9b8d3f0b194d587083d95; run regression tests exercising nf_queue error paths and monitor for use-after-free reports in kernel logs.

Typical attack path

1. Send network packets that reach the nf_queue hook
2. Force an error condition during queuing that skips proper reference handling
3. Trigger dereference of the freed socket structure
4. Achieve memory corruption for denial of service or further exploitation

How to detect it

Review kernel logs for use-after-free warnings or oops messages related to nf_queue and socket reference counting; examine network packet traces for traffic patterns that previously triggered queue errors.

What your security team should do

• Prioritize patching Linux kernels and Android devices within standard change windows given the memory corruption nature
• Monitor EPSS and threat intelligence feeds for any increase in exploitation activity
• Apply network segmentation to limit exposure of unpatched systems to untrusted traffic