CVE-2025-22017

What it actually does

Improper error handling after xa_alloc_cyclic returns a positive value on wrap-around causes ERR_PTR(1) to pass IS_ERR checks, leading to dereference of an unallocated pointer in devlink code paths and potential memory corruption.

Why it matters to the business

Linux kernel systems may experience crashes, unexpected reboots, or local privilege escalation; high ecosystem prevalence in servers, containers, and cloud instances increases urgency for patching despite low observed exploitation rates.

How an attack unfolds

An attacker with local access triggers the cyclic allocation wrap condition in devlink, receives a non-negative return value that bypasses error checks, then dereferences the resulting invalid pointer to corrupt kernel memory or escalate privileges; similar patterns appear in other recent Linux kernel privilege-escalation issues.

How to fix it

Update to fixed kernel commit f8aaa38cfaf6f20afa4db36b6529032fb69165dc or later; for Red Hat OpenShift Serverless clients update to 0:1.6.1-2.el8 or newer; rebuild and reboot with the patched kernel.

How to confirm the fix worked

Verify running kernel contains commit f8aaa38cfaf6f20afa4db36b6529032fb69165dc; confirm devlink xa_alloc_cyclic callers now check for negative error returns; re-test affected code paths under cyclic allocation wrap conditions.

Typical attack path

1. Obtain local unprivileged access on an affected Linux system
2. Invoke devlink operations that exercise xa_alloc_cyclic under wrap-around conditions
3. Trigger the faulty IS_ERR check to obtain a non-allocated pointer
4. Perform subsequent dereference to corrupt kernel structures or gain elevated privileges

How to detect it

Review kernel logs for unexpected NULL or invalid pointer dereferences near devlink; correlate with process activity invoking devlink netlink commands; no public exploitation artifacts reported.

What your security team should do

• Prioritize immediate upgrade of all Linux kernel packages to the listed fixed versions
• Apply patches within standard change windows given absence from CISA KEV and low EPSS
• Monitor for similar error-handling patterns in other kernel subsystems
• Review container and server fleet for the listed affected Red Hat packages