CVE-2022-49840 – This is a use-after-free vulnerability in the L... (How to Fix)

Q: What is the severity of CVE-2022-49840?

CVE-2022-49840 has a CVSS score of 7.8 (HIGH). This is a use-after-free vulnerability in the Linux kernel's BPF subsystem that occurs when bpf_prog_test_run_skb() receives odd-sized data from user space. It allows local attackers to cause kernel memory corruption, potentially leading to privilege escalation or denial of service. Systems running affected Linux kernel versions with BPF enabled are vulnerable.

📋 TL;DR

This is a use-after-free vulnerability in the Linux kernel's BPF subsystem that occurs when bpf_prog_test_run_skb() receives odd-sized data from user space. It allows local attackers to cause kernel memory corruption, potentially leading to privilege escalation or denial of service. Systems running affected Linux kernel versions with BPF enabled are vulnerable.

💻 Affected Systems

Products:

Linux Kernel

Versions: Specific affected versions not explicitly stated in CVE description, but references indicate multiple stable kernel branches were patched.

Operating Systems: Linux distributions using vulnerable kernel versions

Default Config Vulnerable: ⚠️ Yes

Notes: Requires CONFIG_BPF_SYSCALL=y and user ability to load BPF programs. KFENCE (Kernel Electric-Fence) detection makes exploitation more likely to be caught.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Local privilege escalation to root, kernel panic causing system crash, or arbitrary code execution in kernel context.

🟠

Likely Case

Kernel crash leading to denial of service, system instability, or information disclosure from kernel memory.

🟢

If Mitigated

Limited impact if BPF is disabled or access to BPF syscalls is restricted via capabilities/seccomp.

🌐 Internet-Facing: LOW - This requires local access to the system and ability to execute BPF programs.

🏢 Internal Only: MEDIUM - Internal users with shell access or ability to run BPF programs could exploit this vulnerability.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Exploitation requires local access and ability to load BPF programs. The syzkaller fuzzer discovered this issue, suggesting reliable exploitation may be possible.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Multiple stable kernel versions received fixes (see git.kernel.org references)

Vendor Advisory: https://git.kernel.org/stable/c/047824a730699c6c66df43306b80f700c9dfc2fd

Restart Required: Yes

Instructions:

1. Update Linux kernel to patched version from your distribution vendor. 2. Reboot system to load new kernel. 3. Verify kernel version after reboot.

🔧 Temporary Workarounds

Disable BPF syscall

linux

Prevent loading of BPF programs by restricting BPF syscall access

sysctl -w kernel.unprivileged_bpf_disabled=1
Add kernel.unprivileged_bpf_disabled=1 to /etc/sysctl.conf

Use seccomp to block bpf() syscall

linux

Use seccomp filters to prevent BPF program loading

Implement seccomp policy that blocks __NR_bpf (321 on x86_64)

🧯 If You Can't Patch

Restrict user access to BPF functionality via capabilities (CAP_BPF, CAP_SYS_ADMIN)
Implement mandatory access control (SELinux/AppArmor) to restrict BPF usage

🔍 How to Verify

Check if Vulnerable:

Check kernel version against distribution security advisories. Test with: cat /proc/version

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version matches patched release from your distribution. Check that bpf_prog_test_run_skb alignment fix is present in kernel source.

📡 Detection & Monitoring

Log Indicators:

Kernel panic logs
KFENCE error messages about use-after-free in __skb_clone
OOM killer activity related to BPF programs

Network Indicators:

None - this is a local vulnerability

SIEM Query:

source="kernel" AND ("KFENCE" OR "use-after-free" OR "skb_clone")

📊 Metadata

CVE ID: CVE-2022-49840

CVSS v3 Score: 7.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-416

EPSS Score: 0.02% exploit probability (5.9th percentile)

Published: May 1, 2025

Last Updated: October 1, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2022-49840, you might also want to check these: