CVE-2022-48976

What it actually does

Incorrect use of __this_cpu_add() from preemptible context in flow_offload_queue_work() during netfilter flow table cleanup in workqueues without bottom-half disabled, causing kernel warnings or instability instead of safe atomic stat updates.

Why it matters to the business

Potential system instability or crashes during network flow table operations on Linux systems, increasing operational risk and remediation urgency for organizations running affected kernels in network-heavy environments.

How an attack unfolds

An attacker triggers network connection tracking or flow table cleanup paths via crafted traffic or ct actions, leading to flow_offload_queue_work() executing in a preemptible workqueue context where the non-atomic stat increment is called, surfacing the bug.

How to fix it

Update affected Linux kernel packages to versions containing the fix that replaces NF_FLOW_TABLE_STAT_INC with NF_FLOW_TABLE_STAT_INC_ATOMIC in flow_offload_queue_work; for element-hq/element-web (GIT) apply commit 8d7f2b5c1301129a488d3597f3839bd74203ee62.

How to confirm the fix worked

Confirm kernel builds include the atomic stat macro change in nf_flow_table and test flow table cleanup paths under workqueue conditions without observing preemption warnings.

Typical attack path

1. Send traffic that activates connection tracking actions
2. Trigger flow table iteration and cleanup via nf_flow_table_free
3. Invoke tcf_ct_flow_table_cleanup_work in act_ct_workqueue
4. Execute flow_offload_queue_work without bh disabled
5. Hit __this_cpu_add in preemptible context

How to detect it

Review kernel logs for BUG messages referencing __this_cpu_add and flow_offload_queue_work or nf_flow_table callers; inspect workqueue traces involving act_ct or tcf_ct_flow_table_cleanup_work.

What your security team should do

• Prioritize kernel updates on all systems using netfilter flow tables and ct actions
• Monitor for preemptible context warnings in kernel logs related to nf_flow_table
• Apply the referenced commit for any dependent element-hq/element-web deployments
• Test network-heavy workloads post-update to validate stability