CVE-2022-48944

What it actually does

A race condition in Linux kernel sched_fork() exposes an incompletely initialized task via the pidhash before it is placed on the runqueue, allowing concurrent syscalls to access an invalid sched_task_group and trigger memory corruption or use-after-free.

Why it matters to the business

May cause kernel crashes, system instability, or local privilege escalation on Linux hosts and appliances, leading to downtime, data loss, and potential compromise of servers or embedded devices.

How an attack unfolds

An attacker with local access rapidly forks processes while issuing scheduling-related syscalls to win the race window created when a task becomes visible in the pidhash before runqueue placement, resulting in invalid memory access during reweight_entity or similar operations.

How to fix it

Upgrade the Linux kernel to version 5.15.27 or later, or apply commit 3411613611a5cddf7e80908010dc87cb527dd13b; for go2rtc update to 1.9.0 or newer if it embeds the affected scheduler logic.

How to confirm the fix worked

Confirm the running kernel version meets or exceeds 5.15.27; inspect sched/fork.c and fair.c for the reverted race-prone initialization sequence and re-test fork paths under load.

Typical attack path

1. Obtain local unprivileged execution on an affected Linux system
2. Trigger concurrent task creation and scheduling syscalls to hit the sched_fork race
3. Cause invalid memory access leading to kernel panic or controlled corruption
4. Escalate to root privileges or achieve denial of service

How to detect it

Search kernel logs for oops, panic, or warning messages referencing sched_fork, reweight_entity, or sched_task_group; correlate with spikes in process creation from untrusted local users.

What your security team should do

• Prioritize kernel upgrades on all internet-facing and multi-tenant Linux systems
• Apply the fix within standard patch windows given the low EPSS but broad kernel exposure
• Harden local access controls and monitor for unexplained kernel oops or panics
• Track downstream dependents of the stable kernel tree for coordinated updates