CVE-2022-48940

A flaw was found in the Linux kernel's BPF (Berkeley Packet Filter) subsystem. When a BPF map structure contains both a lock and a timer object, improper offset handling during data copying fails to account for both objects. A local user can exploit this vulnerability by updating map elements to overwrite timer data, resulting in kernel memory corruption and a denial of service (DoS) via a system crash.

This vulnerability is rated as Moderate severity rather than Important because exploitation requires local access with elevated privileges (CAP_BPF or CAP_SYS_ADMIN) to define and interact with specific BTF-enabled map configurations, limiting the scope to a local denial of service. In typical enterprise environments, unprivileged accounts cannot construct the advanced map definitions necessary to trigger this condition. Furthermore, successful triggering depends on an uncommon map layout combining both internal timers and spinlocks, restricting the impact strictly to a system crash without risking host confidentiality or data integrity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.