CVE-2022-50889

What it actually does

Use-after-free in dm_integrity_dtr() caused by concurrent dm_resume() and dm_destroy() operations that leave a timer active after the integrity target is destroyed.

Why it matters to the business

Linux systems using device-mapper integrity targets can experience kernel crashes, memory corruption, or potential privilege escalation, leading to service outages and increased risk on affected servers and containers.

How an attack unfolds

An attacker with local access triggers a race between device resume and destroy operations on a dm-integrity target, causing the timer callback to dereference freed memory and resulting in a use-after-free condition.

How to fix it

Update the Linux kernel to a version containing commit 792e51aac376cfb5bd527c2a30826223b82dd177 or later; rebuild and reboot affected systems. For tj-actions/branch-names update to 9.0.0 or newer.

How to confirm the fix worked

Verify the running kernel contains the fix commit, confirm dm_integrity_dtr() calls cancel the timer before freeing structures, and test concurrent resume/destroy operations under load.

Typical attack path

1. Obtain local access on a Linux system using dm-integrity
2. Create or manipulate a dm-integrity target
3. Trigger concurrent dm_resume() and dm_destroy() operations
4. Exploit the resulting UAF for denial of service or code execution

How to detect it

Inspect kernel logs for UAF or timer-related oops in dm-integrity, review audit logs for unusual dmsetup resume/destroy sequences, and search process and module load histories around crash times.

What your security team should do

• Prioritize kernel updates on all systems using device-mapper integrity
• Monitor for kernel oops or panic logs related to dm-integrity
• Apply the fixed commit or distribution kernel package within standard patch cycles
• Review device-mapper configurations to reduce exposure where possible