Loading vulnerability…
Use-after-free race condition in Linux kernel DVB networking
CVE-2022-45886 is a use-after-free vulnerability in the Linux kernel media subsystem's DVB core networking component, dvb_net, affecting kernel versions through 6.0.9. A race between the device disconnect callback and dvb_device_open permits device-node opening to overlap with device teardown, resulting in access to freed memory. A local low-privileged attacker can potentially exploit the flaw to crash the system or escalate privileges.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can cause a kernel crash and system-wide denial of service. Potential privilege escalation could compromise system confidentiality and integrity. Exploitation is timing-dependent and requires access to the affected DVB functionality; this is not an unauthenticated network vulnerability.
If you can’t patch tonight, do this now.
Blacklist the dvb-core kernel module to prevent the affected code from loading. Ensure the module is no longer loaded, rebooting if necessary. This mitigation disables functionality dependent on DVB core support.
Patch, then assume compromise.
Install a vendor kernel update that fixes CVE-2022-45886 and reboot into the updated kernel. Fixed RHEL builds include 4.18.0-513.9.1.el8_9 for RHEL 8 (RHSA-2023:7549), 4.18.0-513.9.1.rt7.311.el8_9 for RHEL 8 real-time kernels (RHSA-2023:7548), 4.18.0-372.80.1.el8_6 for RHEL 8.6 EUS (RHSA-2023:7398), and 4.18.0-477.36.1.el8_8 for RHEL 8.8 EUS (RHSA-2023:7539). Fedora addressed the vulnerability in stable kernel 6.3.7. For applicable Rocky Linux 8.10 CIQ FIPS and CentOS 8.5 deployments, apply updates associated with ciqsa-2026_1663 and CLSA-2023-1695716575, respectively.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.