CVE-2022-49026

What it actually does

Use-after-free in e100_xmit_prepare when skb DMA mapping fails, returning -ENOMEM so the upper layer resends an already-freed skb.

Why it matters to the business

Linux systems using e100 network hardware face risk of kernel crashes or potential code execution, causing service outages; low urgency given no KEV listing and stable low EPSS.

How an attack unfolds

An attacker induces conditions where skb mapping fails in the e100 driver during transmission; the freed skb is resent by upper layers, enabling UAF access to kernel memory. Listed threat actors in 2024 zero-day and Linux kernel campaigns could leverage similar patterns though this specific issue shows no confirmed exploitation.

How to fix it

Apply the upstream fix referenced in commit dbce253166f6b10ff3e0c09e50fd395370b8b065 or equivalent kernel update removing the premature free; rebuild and deploy the patched kernel on affected systems.

How to confirm the fix worked

Confirm the e100 driver source no longer frees the skb on mapping failure; test by exercising transmit paths under memory pressure and verify no UAF reports in kernel logs.

Typical attack path

1. Establish network connectivity to trigger e100 transmission path
2. Force skb mapping failure in e100_xmit_prepare
3. Allow upper layer to resend the freed skb
4. Access or corrupt kernel memory via UAF for crash or escalation

How to detect it

Inspect kernel logs for e100 transmit errors or UAF warnings; correlate with network activity spikes on e100 interfaces; review threat actor mentions of Linux kernel UAF or out-of-bounds issues for related patterns.

What your security team should do

• Prioritize patching e100 driver in Linux kernels on systems with e100 hardware
• Monitor for kernel oops or UAF warnings in dmesg on affected hosts
• Review network driver usage and consider hardware replacement where feasible