In the nucleus linux revealed vulnerability (cve-2022-1729 ), which allows a local user to get a ROOT access to the system. The vulnerability is caused by the state of the race in the subsystem perf , which can be used to initiate an appeal to the already liberated area of the nucleus (uce-aphter-free) . The problem is manifested starting with the release of the nucleus 4.0-RC1. The possibility of operation is confirmed for issues of 5.4.193+.
Correction is still available only in the form of patch >. The danger of vulnerability smooths out the fact that most of the default distributions limit access to Perf for unconvilled users. As a bypass protection path, you can set the Syssctl parameter Kernel.perf_event_paranoid to 3.
/Media reports.