CVE-2022-1199 in Linux
Summary
by MITRE • 08/29/2022
A flaw was found in the Linux kernel. This flaw allows an attacker to crash the Linux kernel by simulating amateur radio from the user space, resulting in a null-ptr-deref vulnerability and a use-after-free vulnerability.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 04/04/2026
The vulnerability identified as CVE-2022-1199 represents a critical security flaw within the Linux kernel that stems from improper handling of amateur radio simulation operations executed from user space. This vulnerability manifests through two distinct but interconnected issues that together create a pathway for kernel-level exploitation. The flaw specifically affects the kernel's radio subsystem where user-space applications can trigger kernel operations through the Amateur Radio API interfaces, creating conditions that lead to system instability and potential denial of service scenarios.
The technical implementation of this vulnerability involves a null pointer dereference followed by a use-after-free condition within the kernel's radio handling code. When user-space applications simulate amateur radio operations, they can manipulate kernel data structures in ways that result in memory management errors. The null pointer dereference occurs when the kernel attempts to access memory through a pointer that has not been properly initialized or has been set to NULL, while the use-after-free vulnerability emerges when the kernel continues to reference memory that has already been freed and potentially reallocated. These memory management errors directly violate fundamental kernel security principles and create opportunities for arbitrary code execution or system crashes.
The operational impact of CVE-2022-1199 extends beyond simple system crashes to potentially enable more sophisticated attacks within the kernel context. An attacker who successfully exploits this vulnerability can cause the Linux kernel to crash, leading to system-wide denial of service conditions that can affect critical infrastructure operations. The vulnerability's exploitation requires only user-space privileges, making it particularly concerning as it can be triggered by unprivileged users without requiring elevated access rights. This characteristic aligns with ATT&CK technique T1068 which describes the exploitation of legitimate credentials and privileges to gain access to systems, though in this case the vulnerability operates at a lower privilege level within the kernel space.
From a compliance and security framework perspective, this vulnerability maps directly to CWE-476 which describes null pointer dereference conditions, and CWE-416 which addresses use-after-free errors. The vulnerability represents a failure in kernel memory management that violates the principle of least privilege and proper resource handling. Organizations running Linux systems that support amateur radio functionality or have radio-related kernel modules enabled are at risk of experiencing system instability or complete system crashes. The vulnerability's impact is particularly severe in environments where system uptime is critical, such as telecommunications infrastructure, industrial control systems, or any mission-critical applications that depend on continuous kernel operation.
Mitigation strategies for CVE-2022-1199 should focus on immediate kernel updates from the vendor to address the specific memory management issues in the radio subsystem. System administrators should also consider implementing runtime protections such as kernel lockdown modes and restricting access to radio simulation interfaces for non-privileged users. The vulnerability highlights the importance of proper input validation and memory management within kernel space, emphasizing that even seemingly benign user-space operations can create critical kernel-level security issues. Organizations should conduct vulnerability assessments to identify systems running affected kernel versions and ensure that all radio-related kernel modules are properly patched and monitored for potential exploitation attempts.