{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2022-49920", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-05-01T14:05:17.252Z", "datePublished": "2025-05-01T14:10:59.436Z", "dateUpdated": "2026-08-05T08:56:41.698Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T08:56:41.698Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: netlink notifier might race to release objects\n\ncommit release path is invoked via call_rcu and it runs lockless to\nrelease the objects after rcu grace period. The netlink notifier handler\nmight win race to remove objects that the transaction context is still\nreferencing from the commit release path.\n\nCall rcu_barrier() to ensure pending rcu callbacks run to completion\nif the list of transactions to be destroyed is not empty." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The bug is reached via NETLINK_NETFILTER/nftables syscalls (create an owned table, commit deletions, then close the socket to fire NETLINK_URELEASE). This is a local netlink path, not packet-triggered remote code.\nAC:L - The attacker controls both sides of the race: committing nftables deletions that schedule async destroy work, then closing the owned netlink socket to trigger nft_rcv_nl_event. No external timing or victim state is required.\nPR:L - nfnetlink only requires CAP_NET_ADMIN via netlink_net_capable() in the network namespace’s user_ns, which an unprivileged user obtains with user+net namespaces. NFT_TABLE_F_OWNER setup is reachable without real root.\nUI:N - Exploitation needs only the attacker’s own netlink operations and socket close; no other user action is required.\nS:U - Impact is confined to the local kernel (standard nftables UAF/privilege escalation). It does not cross a VM, IOMMU, or other security-authority boundary.\nC:H - Syzbot confirms a KASAN use-after-free in nft_commit_release/nf_tables_trans_destroy_work after __nft_release_table frees objects still referenced by pending transactions; UAF of heap objects enables arbitrary read primitives.\nI:H - The same double-free/UAF of nftables chains/rules/sets is heap-controllable and can be turned into arbitrary write or control-flow hijacking, consistent with other exploitable nf_tables UAFs.\nA:H - The UAF reliably causes kernel oops/panic (observed KASAN crash in destroy work), so availability impact is high even without a full exploit." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/netfilter/nf_tables_api.c" ], "versions": [ { "version": "6001a930ce0378b62210d4f83583fc88a903d89d", "lessThan": "1ffe7100411a8b9015115ce124cd6c9c9da6f8e3", "status": "affected", "versionType": "git" }, { "version": "6001a930ce0378b62210d4f83583fc88a903d89d", "lessThan": "e40b7c44d19e327ad8b49a491ef1fa8dcc4566e0", "status": "affected", "versionType": "git" }, { "version": "6001a930ce0378b62210d4f83583fc88a903d89d", "lessThan": "d4bc8271db21ea9f1c86a1ca4d64999f184d4aae", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/netfilter/nf_tables_api.c" ], "versions": [ { "version": "5.12", "status": "affected" }, { "version": "0", "lessThan": "5.12", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.78", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.0.8", "lessThanOrEqual": "6.0.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.12", "versionEndExcluding": "5.15.78" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.12", "versionEndExcluding": "6.0.8" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.12", "versionEndExcluding": "6.1" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/1ffe7100411a8b9015115ce124cd6c9c9da6f8e3" }, { "url": "https://git.kernel.org/stable/c/e40b7c44d19e327ad8b49a491ef1fa8dcc4566e0" }, { "url": "https://git.kernel.org/stable/c/d4bc8271db21ea9f1c86a1ca4d64999f184d4aae" } ], "title": "netfilter: nf_tables: netlink notifier might race to release objects", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "problemTypes": [ { "descriptions": [ { "type": "CWE", "cweId": "CWE-362", "lang": "en", "description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')" } ] } ], "metrics": [ { "cvssV3_1": { "scope": "UNCHANGED", "version": "3.1", "baseScore": 4.7, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE" } }, { "other": { "type": "ssvc", "content": { "timestamp": "2025-10-01T14:58:43.450275Z", "id": "CVE-2022-49920", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "version": "2.0.3" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-01T14:58:46.228Z" } } ] } }