CVE-2022-48939

What it actually does

BPF batch map operations lack schedule points, allowing unbounded processing of large data sets that can trigger soft lockups and RCU barrier hangs in the Linux kernel.

Why it matters to the business

Systems running affected Linux kernels may experience temporary unresponsiveness or hangs when local processes use BPF batch operations on large maps, reducing availability until the kernel recovers or the system is rebooted.

How an attack unfolds

An attacker with local access crafts or invokes a BPF program that performs batch operations (such as delete) against a map containing a very large number of entries; the lack of voluntary schedule points keeps the kworker thread busy for extended periods, starving other tasks and producing soft lockup warnings.

How to fix it

Update the Linux kernel to a version containing commit 7ef94bfb08fb9e73defafbd5ddef6b5a0e2ee12b or later; Android devices should apply the SoCVersion 2021-12-05 or newer vendor patches that include the equivalent fix.

How to confirm the fix worked

Confirm the running kernel contains the referenced commit or a back-port that adds cond_resched() or schedule points inside the batch operation loops; re-run syzkaller-style batch operation fuzzers and verify absence of soft lockup warnings.

Typical attack path

1. Obtain local user or container access on a vulnerable Linux kernel
2. Load or trigger a BPF program that executes batch map operations on a map with millions of entries
3. Sustain the batch operation long enough to exceed scheduler and RCU grace-period timeouts
4. Observe or wait for soft lockup or hung-task reports that degrade system responsiveness

How to detect it

Search kernel logs for repeated 'blocked for more than 140 seconds' or 'INFO: task hung in rcu_barrier' messages associated with kworker threads; correlate with processes that recently performed BPF map batch operations.

What your security team should do

• Prioritize kernel upgrades on any multi-tenant or container hosts where untrusted workloads can load BPF programs
• Monitor for soft lockup and hung-task kernel messages as an early indicator of exposure
• Restrict unprivileged BPF program loading via sysctl until patches are applied