CVE-2022-48988: memcg: fix possible use-after-free in memcg_write_event_control()
In the Linux kernel, the following vulnerability has been resolved:
memcg: fix possible use-after-free in memcg_write_event_control()
memcg_write_event_control() accesses the dentry->d_name of the specified
control fd to route the write call. As a cgroup interface file can't be
renamed, it's safe to access d_name as long as the specified file is a
regular cgroup file. Also, as these cgroup interface files can't be
removed before the directory, it's safe to access the parent too.
Prior to 347c4a874710 ("memcg: remove cgroup_event->cft"), there was a
call to __file_cft() which verified that the specified file is a regular
cgroupfs file before further accesses. The cftype pointer returned from
__file_cft() was no longer necessary and the commit inadvertently dropped
the file type check with it allowing any file to slip through. With the
invarients broken, the d_name and parent accesses can now race against
renames and removals of arbitrary files and cause use-after-free's.
Fix the bug by resurrecting the file type check in __file_cft(). Now that
cgroupfs is implemented through kernfs, checking the file operations needs
to go through a layer of indirection. Instead, let's check the superblock
and dentry type.
Security readout for executives and security teams
Plain-English summary
This is a Linux kernel memory-safety flaw in the memory cgroup event-control path. A dropped validation check allowed non-cgroup files to be processed, creating a race with file rename or removal and possible use-after-free. The sources do not provide CVSS, impact rating, or exploitation evidence.
Executive priority
Handle through normal kernel patch governance unless local untrusted users or multi-tenant workloads increase risk. No active exploitation evidence is provided, but kernel use-after-free bugs can have high operational impact if weaponized.
Technical view
memcg_write_event_control() used dentry name and parent assumptions that are only safe for regular cgroupfs files. Commit 347c4a874710 removed the __file_cft() check, allowing arbitrary files through and enabling races against rename/removal. Kernel stable fixes restore file-type validation using superblock and dentry checks.
Likely exposure
Exposure is limited to Linux kernels carrying the introduced regression before the referenced stable fixes. The bundle lists Linux as affected and references fixes across stable branches. The source does not establish remote reachability, required privileges, or container escape impact.
Exploitation context
The CVE is not listed as KEV, and the provided sources do not claim active exploitation or public exploit availability. Treat exploitation context as incomplete; only the use-after-free condition and kernel fix rationale are source-supported.
Researcher notes
The key regression is loss of regular cgroup file validation in memcg_write_event_control(). The fix reintroduces validation in __file_cft() adapted for kernfs. Sources do not provide a CWE, CVSS vector, proof of exploitability, or privilege boundary assessment.
Mitigation direction
Identify Linux kernel versions deployed across servers and appliances.
Check distribution advisories for backported fixes for CVE-2022-48988.
Upgrade to a kernel containing the referenced stable fix for your branch.
Prioritize shared hosts and systems exposing cgroup interfaces to untrusted workloads.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Potential ATT&CK relevance
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
cve · low confidence lookup
CVE-2022-48988 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.