LiveActive security incident?Get immediate response
CVE Record

CVE-2022-48989: fscache: Fix oops due to race with cookie_lru and use_cookie

In the Linux kernel, the following vulnerability has been resolved: fscache: Fix oops due to race with cookie_lru and use_cookie If a cookie expires from the LRU and the LRU_DISCARD flag is set, but the state machine has not run yet, it's possible another thread can call fscache_use_cookie and begin to use it. When the cookie_worker finally runs, it will see the LRU_DISCARD flag set, transition the cookie->state to LRU_DISCARDING, which will then withdraw the cookie. Once the cookie is withdrawn the object is removed the below oops will occur because the object associated with the cookie is now NULL. Fix the oops by clearing the LRU_DISCARD bit if another thread uses the cookie before the cookie_worker runs. BUG: kernel NULL pointer dereference, address: 0000000000000008 ... CPU: 31 PID: 44773 Comm: kworker/u130:1 Tainted: G E 6.0.0-5.dneg.x86_64 #1 Hardware name: Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022 Workqueue: events_unbound netfs_rreq_write_to_cache_work [netfs] RIP: 0010:cachefiles_prepare_write+0x28/0x90 [cachefiles] ... Call Trace: netfs_rreq_write_to_cache_work+0x11c/0x320 [netfs] process_one_work+0x217/0x3e0 worker_thread+0x4a/0x3b0 kthread+0xd6/0x100

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This Linux kernel issue is a race condition in FS-Cache handling that can crash kernel work processing with a NULL pointer dereference. The public record shows a kernel oops, so the clearest business risk is availability disruption on affected Linux systems using these cache paths.

Executive priority

Treat this as a targeted availability-risk kernel maintenance item, not as a confirmed emergency. Patch through normal kernel update channels, with higher priority for production systems using filesystem caching or network-backed storage.

Technical view

The bug occurs when an FS-Cache cookie marked for LRU discard is reused before the cookie worker withdraws it. The worker can later remove the associated object, leaving cachefiles_prepare_write to dereference a NULL object. The fix clears LRU_DISCARD when another thread reuses the cookie first.

Likely exposure

Exposure is most plausible on Linux systems running affected kernel versions with FS-Cache, cachefiles, or netfs caching paths in use. The provided data lists Linux 5.17, 6.0.13, and 6.1-related version information, but exact distro package ranges require vendor advisories.

Exploitation context

CISA KEV status is false in the provided bundle, and no cited source reports active exploitation. The sources describe a race-triggered kernel oops, not a public exploit chain. Required privileges, remote reachability, and practical attacker control are not established here.

Researcher notes

Evidence supports a concurrency flaw fixed upstream, but public metadata lacks CVSS, CWE, exploitation details, and precise distribution package ranges. Validation should focus on affected kernel lineage, feature usage, and whether downstream vendors backported the two stable commits.

Mitigation direction

  • Apply Linux kernel or distribution updates containing the referenced stable fixes.
  • Check your OS vendor advisory for exact affected and fixed package versions.
  • Prioritize hosts using FS-Cache, cachefiles, netfs, or network filesystem caching.
  • If patching is delayed, follow vendor guidance for reducing FS-Cache exposure.
  • Avoid direct wrangler deploy-style shortcuts; use normal approved maintenance workflows.

Validation and detection

  • Inventory kernel versions across Linux fleets and compare with vendor advisories.
  • Identify systems loading or using fscache, cachefiles, or netfs components.
  • Review kernel logs for oops traces involving cachefiles_prepare_write or netfs_rreq_write_to_cache_work.
  • Confirm updated kernels include the linked upstream stable commits or distro backports.
  • Run regression checks for workloads relying on network filesystem caching.
Prepared
Confidence
medium
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2022-48989 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
1ADP providers
3Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux12bb21a29c19aae50cfad4e2bb5c943108f34a7d, 12bb21a29c19aae50cfad4e2bb5c943108f34a7dunaffected
LinuxLinux5.17, 0, 6.0.13, 6.1affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.