CVE-2022-48989

What it actually does

Race condition in fscache cookie LRU handling allows concurrent fscache_use_cookie to reuse a cookie after LRU_DISCARD is set but before cookie_worker runs, resulting in LRU_DISCARDING state, cookie withdrawal, and NULL object dereference causing kernel oops in cachefiles_prepare_write.

Why it matters to the business

Linux systems using fscache or netfs caching can experience unexpected kernel panics leading to system crashes, downtime, and potential loss of in-progress I/O operations; low EPSS and no KEV status indicate limited in-the-wild exploitation risk despite mentions in broad 2024 campaign reports.

How an attack unfolds

Local attacker triggers concurrent fscache cookie operations so one thread expires the cookie via LRU while another calls use_cookie; when the delayed cookie_worker executes it transitions to LRU_DISCARDING, withdraws the cookie, and dereferences the now-NULL object in netfs write-to-cache work.

How to fix it

Upgrade the Linux kernel to a version containing the fix that clears the LRU_DISCARD bit when a cookie is reused before the worker runs; no specific per-package fixed versions listed for kernel components.

How to confirm the fix worked

Verify kernel source contains the race fix (clear LRU_DISCARD on reuse), reproduce the original oops scenario in a test environment, and confirm absence of NULL dereference in cachefiles/netfs paths.

Typical attack path

1. Obtain local code execution on affected Linux kernel
2. Perform concurrent fscache cookie LRU discard and use_cookie operations
3. Allow cookie_worker to process the stale LRU_DISCARD flag
4. Trigger NULL dereference during cachefiles_prepare_write

How to detect it

Search kernel logs and dmesg for NULL pointer dereference involving cachefiles_prepare_write or netfs_rreq_write_to_cache_work; correlate with kworker threads and events_unbound workqueues around the time of crash.

• BUG: kernel NULL pointer dereference, address: 0000000000000008
• cachefiles_prepare_write+0x28/0x90 [cachefiles]
• netfs_rreq_write_to_cache_work+0x11c/0x320 [netfs]
• Workqueue: events_unbound netfs_rreq_write_to_cache_work

What your security team should do

• Apply available kernel updates addressing fscache races as soon as feasible
• Monitor kernel logs for cachefiles and netfs crashes
• Restrict use of fscache on high-risk systems until patched
• Review downstream dependents for any indirect impact