CVE-2022-49236

CVE-2022-49236 describes a Use-After-Free (UAF) vulnerability in the Linux kernel's BPF subsystem, specifically affecting how module BTF (BPF Type Format) is handled during module loading. This flaw arises from a race condition between btf_try_get_module and load_module, where a BPF program can successfully load and acquire a reference to a module that is still undergoing initialization. If the module's initialization subsequently fails, it can be freed while the BPF program still holds a reference, leading to a UAF when the program attempts to release that reference. The vulnerability carries a CVSSv3.1 score of 7.8 (High), indicating that a local attacker with low privileges can exploit this with low attack complexity, potentially leading to high impacts on confidentiality, integrity, and availability. This means an attacker could achieve privilege escalation, data corruption, or system crashes. Currently, there is no evidence of active exploitation, nor are there any publicly available exploit modules or proof-of-concept code on platforms like Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are minimal, suggesting it has not garnered significant public attention.