CVE-2022-48974

What it actually does

Incorrect use of __this_cpu_add() for NF_CT_STAT_INC() inside nf_conntrack_hash_check_insert() and related paths when nf_ct_ext_valid_pre/post() checks fail, executed in preemptible context instead of atomic or disabled-preemption context, triggering BUG: using __this_cpu_add() in preemptible code.

Why it matters to the business

Network-intensive systems may experience kernel crashes or instability during connection tracking operations, increasing downtime risk for services relying on netfilter; low exploitability and no known active campaigns reduce immediate urgency despite the 2024 disclosure.

How an attack unfolds

An attacker triggers conntrack creation through netlink messages (ctnetlink_new_conntrack) that reach nf_conntrack_hash_check_insert(), causing the non-atomic stat increment in a preemptible context and surfacing the BUG trace; no public exploits or named threat actors are associated.

How to fix it

Upgrade the Linux kernel to a version containing the fix (post-949bc6fe31f3175c9e1864d30cf6c8110179ac14 equivalent) or apply the patch that replaces NF_CT_STAT_INC() with NF_CT_STAT_INC_ATOMIC() in the affected nf_ct_ext_valid paths; verify the change in nf_conntrack_hash_check_insert() and __nf_conntrack_confirm().

How to confirm the fix worked

Confirm the updated source contains NF_CT_STAT_INC_ATOMIC() calls for nf_ct_ext_valid_pre/post() in nf_conntrack_hash_check_insert(); test by exercising conntrack insertion under load and ensuring no preemptible-context BUG traces appear in dmesg.

Typical attack path

1. Send network traffic or netlink requests that invoke ctnetlink_create_conntrack
2. Force nf_ct_ext_valid_pre/post() failure path inside nf_conntrack_hash_check_insert()
3. Execute in preemptible context to hit the __this_cpu_add() misuse
4. Observe resulting kernel BUG and potential system instability

How to detect it

Inspect kernel logs (dmesg, /var/log/kern.log) for the exact BUG string mentioning __this_cpu_add and nf_conntrack_hash_check_insert; correlate with netlink or conntrack creation events from processes using nfnetlink.

What your security team should do

• Prioritize kernel updates on systems with heavy netfilter/conntrack usage
• Monitor for related upstream stable releases and backports
• Review netfilter configuration to minimize unnecessary conntrack creation if patching is delayed