CVE-2022-48800
📋 TL;DR
This CVE describes a deadlock vulnerability in the Linux kernel's memory management subsystem where kcompactd (kernel compaction daemon) can become stuck in a soft lockup condition. This occurs when memory reclaim throttling fails to make progress, preventing page migration and causing system instability. It affects Linux systems with specific kernel configurations, particularly those built without CONFIG_PREEMPT.
💻 Affected Systems
- Linux kernel
📦 What is this software?
Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →⚠️ Risk & Real-World Impact
Worst Case
System becomes completely unresponsive due to kernel soft lockup, requiring hard reboot and potentially causing data loss or corruption.
Likely Case
Degraded system performance, application failures due to memory allocation issues, and potential system hangs requiring intervention.
If Mitigated
Minor performance impact during memory pressure situations, with automatic recovery possible in some scenarios.
🎯 Exploit Status
Exploitation requires triggering specific memory management conditions and likely local access. No public exploit code referenced.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Patches available in stable kernel trees via git commits referenced in CVE
Vendor Advisory: https://git.kernel.org/stable/c/3980cff6349687f73d5109f156f23cb261c24164
Restart Required: Yes
Instructions:
1. Update Linux kernel to patched version from your distribution's repositories. 2. For custom kernels, apply patches from git.kernel.org. 3. Reboot system to load new kernel.
🔧 Temporary Workarounds
Enable swap space
linuxAdding swap space may reduce likelihood of triggering the deadlock by providing additional memory pressure relief.
sudo fallocate -l 4G /swapfile
sudo chmod 600 /swapfile
sudo mkswap /swapfile
sudo swapon /swapfile
Add to /etc/fstab: /swapfile none swap sw 0 0
Memory pressure monitoring
linuxMonitor system memory usage and restart services before reaching critical memory pressure levels.
# Monitor memory usage regularly
watch -n 5 free -h
# Set up alerts for high memory usage
🧯 If You Can't Patch
- Monitor system logs for 'soft lockup' messages and 'kcompactd' warnings
- Implement aggressive memory usage limits on applications to prevent triggering conditions
🔍 How to Verify
Check if Vulnerable:
Check kernel version and configuration: uname -r and check if CONFIG_PREEMPT=n in kernel configCheck Version:
uname -rVerify Fix Applied:
Verify kernel version is updated and check dmesg for absence of 'soft lockup' messages related to kcompactd📡 Detection & Monitoring
Log Indicators:
- kernel: watchdog: BUG: soft lockup - CPU# stuck for ... [kcompactd0:
- kernel: Node 0 all_unreclaimable? yes
- kernel: too_many_isolated messages
Network Indicators:
- None - this is a local kernel issue
SIEM Query:
source="kernel" AND ("soft lockup" AND "kcompactd" OR "all_unreclaimable")