CVE-2022-49236: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-49236 is a use-after-free vulnerability discovered in the Linux kernel's BPF (Berkeley Packet Filter) subsystem. The vulnerability exists in the interaction between btf_try_get_module and load_module functions, where a race condition can occur during module loading. This vulnerability was disclosed in February 2025 and affects the Linux kernel's BTF (BPF Type Format) implementation (Kernel Git).

The vulnerability occurs when BTF parsing happens from MODULE_STATE_COMING notifier callback, before module initcalls are invoked. The notifier callback parses and prepares the module BTF, allocates an ID, publishes it to userspace, and adds it to btf_modules list. However, the module is not fully initialized at this point, and the code in module.c can fail and free the module without considering other users. This creates a race condition where btf_try_get_module can succeed between MODULE_STATE_COMING to MODULE_STATE_LIVE state transition, leading to a use-after-free condition when the BPF program loads successfully but the module initialization fails (Kernel Git). The vulnerability has been assigned a CVSS v3.1 base score of 7.8 (High) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (NVD).

The vulnerability can allow an attacker with local access to potentially corrupt system memory, crash the system, or escalate privileges. The use-after-free condition can be triggered when a BPF program loads successfully during the state transition, but the module's initialization fails, leading to potential memory corruption (Red Hat).

The vulnerability requires local access and low privileges to exploit. The race condition can be triggered during module loading when specific conditions are met in the module initialization process. The vulnerability is particularly concerning as it affects the kernel's BPF subsystem, which is commonly used in many Linux systems (NVD).

The fix involves setting a BTF_MODULE_F_LIVE flag from the notifier callback when MODULE_STATE_LIVE state is reached for the module. This ensures that btf_try_get_module returns NULL for modules that are not fully formed. The fix has been implemented in the kernel, and system administrators should update to a patched version (Kernel Git).