CVE-2022-48991

What it actually does

Missing MMU notifier invocations during page table entry zapping in khugepaged collapse paths for shmem/tmpfs and THP allows secondary MMUs to retain references to freed pages, resulting in use-after-free.

Why it matters to the business

Systems running virtualized workloads or using shared memory with transparent huge pages face elevated risk of kernel crashes, data corruption, or potential privilege escalation; the flaw affects a wide range of Linux distributions and downstream packages, increasing operational exposure until patched.

How an attack unfolds

An attacker with local access triggers khugepaged to collapse PTE-mapped THP or shmem pages; because MMU notifiers are omitted, a secondary MMU such as KVM continues accessing the now-freed page, enabling use-after-free exploitation that can lead to arbitrary code execution or container escape.

How to fix it

Upgrade the Linux kernel to a version containing commit 275c626c131cfe141beeb6c575e31fa53d32da19 or later stable equivalents; Firefox packages should be updated to 131.0.3-r0 or newer. Reboot after kernel updates and verify no custom out-of-tree modules interfere with khugepaged.

How to confirm the fix worked

Confirm the running kernel contains the fix by checking git commit history or package version strings; run regression tests exercising shmem collapse under KVM; monitor dmesg for related notifier warnings after upgrade.

Typical attack path

1. Obtain local code execution on a vulnerable Linux host
2. Allocate and map memory in shmem or tmpfs to encourage khugepaged activity
3. Trigger PMD collapse while a secondary MMU (KVM) holds mirrored mappings
4. Reuse the freed page via the stale secondary MMU reference to achieve UAF
5. Escalate privileges or escape virtualization boundaries

How to detect it

Review kernel audit logs and dmesg for unexpected page table operations around khugepaged; correlate with KVM MMU flush events or secondary MMU faults; examine crash dumps for use-after-free signatures in mm/huge_memory.c paths.

What your security team should do

• Prioritize kernel upgrades on all systems hosting KVM guests or heavy shmem workloads within the next maintenance window
• Enable kernel live patching where available to reduce reboot requirements
• Review virtualization configurations to limit untrusted local access until patched
• Update monitoring rules to watch for khugepaged-related page faults or KVM MMU inconsistencies