CVE-2022-49020

What it actually does

Failure to call sock_release() on error paths in p9_fd_create_tcp() and p9_fd_create_unix() when p9_trans_fd creation fails inside p9_socket_open(), resulting in leaked sockets in the Linux kernel 9p transport layer.

Why it matters to the business

Gradual exhaustion of socket resources on Linux systems using the 9p filesystem protocol can eventually impact network operations and service availability; the issue has low exploitation likelihood and no known ransomware use, with fixes available since late 2024 publication.

How an attack unfolds

An attacker with the ability to trigger repeated 9p TCP or Unix socket creation attempts that fail at the p9_trans_fd stage can cause sockets to accumulate without release; listed threat actor campaigns targeting Linux kernel resource issues could theoretically leverage similar patterns though no public exploit exists for this specific leak.

How to fix it

Update the Linux kernel to a version containing commit 0396227f4daf4792a6a8aaa3b7771dc25c4cd443 or later; for affected gitlab-org/gitlab deployments apply commit 84cf95d60d2691201b17bb4d41a95987ded847fb.

How to confirm the fix worked

Confirm the running kernel contains the referenced commit hash or is newer than the vulnerable versions; review 9p socket allocation code paths for the added sock_release() call on p9_trans_fd failure.

Typical attack path

1. Identify systems exposing or using 9p mounts over TCP or Unix sockets
2. Repeatedly initiate 9p connection attempts engineered to fail after socket allocation but before p9_trans_fd succeeds
3. Observe gradual increase in unreleased sockets until system limits are reached

How to detect it

Search kernel logs and audit records for repeated 9p socket creation failures without corresponding release events; track socket descriptor counts over time on systems with 9p mounts; correlate with any listed threat actor activity involving Linux kernel resource vulnerabilities.

What your security team should do

• Prioritize kernel upgrades to the listed fixed commits on all systems using 9p
• Monitor socket usage metrics on 9p-enabled hosts until patches are deployed
• Review 9p configuration to limit unnecessary network filesystem mounts