CVE-2022-48933

What it actually does

The vulnerability causes a memory leak when updating stateful objects in nf_tables because the temporary object created for the update calls init but is released with kfree instead of the destroy function, and module refcount handling is inconsistent.

Why it matters to the business

Repeated updates to stateful nftables objects can exhaust kernel memory over time on widely deployed Linux systems, potentially causing gradual resource exhaustion and operational instability.

How an attack unfolds

An attacker with local privileges performs multiple updates to stateful nftables objects via the control plane, triggering the flawed release path that leaks resources without proper cleanup.

How to fix it

Update the Linux kernel to a version containing commit 53026346a94c43f35c32b18804041bc483271d87 or later.

How to confirm the fix worked

Confirm the running kernel includes the referenced fix commit and test stateful object updates to verify absence of leaks via memory accounting tools.

Typical attack path

1. Obtain local access to a Linux system using nftables
2. Use netlink or nft command-line interface to repeatedly update stateful objects
3. Trigger allocation of temporary objects that leak on release

How to detect it

Examine kernel logs and memory statistics for repeated nf_tables object allocations without corresponding releases; correlate with administrative nftables configuration changes.

What your security team should do

• Apply kernel updates containing the fix to all affected Linux distributions promptly
• Review nftables configurations for stateful object usage and reduce unnecessary updates where possible
• Monitor kernel memory usage metrics for anomalies on systems exposing netfilter interfaces