CVE-2022-49087: 
Linux Kernel vulnerability analysis and mitigation

In the Linux kernel, a race condition vulnerability was discovered in the rxrpc_exit_net() function. The vulnerability was identified and fixed in 2022, affecting the RxRPC protocol implementation. The issue occurs during network namespace cleanup operations, where a race between rxrpc_exit_net() and rxrpc_peer_keepalive_worker() functions could lead to a use-after-free condition (Kernel Git).

The vulnerability stems from incorrect ordering of operations in rxrpc_exit_net(). The race condition occurs when CPU0 executes rxrpc_exit_net() while CPU1 executes rxrpc_peer_keepalive_worker(). The sequence involves setting rxnet->live to false, followed by del_timer_sync() and cancel_work_sync() calls, but the timer can still be armed by the keepalive worker, leading to a use-after-free condition. This was confirmed through debug object warnings showing active timer_list objects being freed (Kernel Git).

The vulnerability can result in use-after-free conditions in the kernel's RxRPC implementation, potentially leading to memory corruption and system stability issues. This could affect systems using the RxRPC protocol, particularly in networked environments where namespace cleanup operations occur (Kernel Git).

The vulnerability requires specific timing conditions to be met between concurrent operations in the kernel's RxRPC subsystem. While the issue was discovered through automated testing using syzkaller, there are no known public exploits targeting this vulnerability (Kernel Git).

The fix involves reordering the cleanup operations in rxrpc_exit_net() to ensure the work is cancelled before the timer is deleted. This prevents the race condition by ensuring proper synchronization between the cleanup and keepalive operations. The fix was implemented by moving the del_timer_sync() call after cancel_work_sync() (Kernel Git).