Log in Start free

Vulnerability · Published May 1, 2025 · Assigned by Linux

CVE-2022-49919netfilter: nf_tables: release flow rule object from commit path

High 7.8

In plain English

A high-severity use-after-free in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 5% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.2%top 94.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: release flow rule object from commit path No need to postpone this to the commit release path, since no packets are walking over this object, this is accessed from control plane only. This helped uncovered UAF triggered by races with the netlink notifier.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12linux6.0.8-1DEBIAN-CVE-2022-49919
Debian:13linux6.0.8-1DEBIAN-CVE-2022-49919
Debian:14linux6.0.8-1DEBIAN-CVE-2022-49919
Ubuntu:22.04:LTSlinux5.15.0-60.66UBUNTU-CVE-2022-49919
Ubuntu:22.04:LTSlinux-allwinner-5.19no fix listedUBUNTU-CVE-2022-49919
Ubuntu:22.04:LTSlinux-aws5.15.0-1030.34UBUNTU-CVE-2022-49919
Ubuntu:22.04:LTSlinux-aws-5.19no fix listedUBUNTU-CVE-2022-49919
Ubuntu:22.04:LTSlinux-aws-6.2no fix listedUBUNTU-CVE-2022-49919
Ubuntu:22.04:LTSlinux-aws-6.5no fix listedUBUNTU-CVE-2022-49919
Ubuntu:22.04:LTSlinux-azure5.15.0-1033.40UBUNTU-CVE-2022-49919
Ubuntu:22.04:LTSlinux-azure-5.19no fix listedUBUNTU-CVE-2022-49919
Ubuntu:22.04:LTSlinux-azure-6.2no fix listedUBUNTU-CVE-2022-49919
Ubuntu:22.04:LTSlinux-azure-6.5no fix listedUBUNTU-CVE-2022-49919
Ubuntu:22.04:LTSlinux-azure-fde5.15.0-1033.40.1UBUNTU-CVE-2022-49919
Ubuntu:22.04:LTSlinux-azure-fde-5.19no fix listedUBUNTU-CVE-2022-49919
Ubuntu:22.04:LTSlinux-azure-fde-6.2no fix listedUBUNTU-CVE-2022-49919
Ubuntu:22.04:LTSlinux-gcp5.15.0-1029.36UBUNTU-CVE-2022-49919
Ubuntu:22.04:LTSlinux-gcp-5.19no fix listedUBUNTU-CVE-2022-49919
Ubuntu:22.04:LTSlinux-gcp-6.2no fix listedUBUNTU-CVE-2022-49919
Ubuntu:22.04:LTSlinux-gcp-6.5no fix listedUBUNTU-CVE-2022-49919
Ubuntu:22.04:LTSlinux-gke5.15.0-1027.32UBUNTU-CVE-2022-49919
Ubuntu:22.04:LTSlinux-gkeop5.15.0-1015.19UBUNTU-CVE-2022-49919
Ubuntu:22.04:LTSlinux-hwe-5.19no fix listedUBUNTU-CVE-2022-49919
Ubuntu:22.04:LTSlinux-hwe-6.2no fix listedUBUNTU-CVE-2022-49919
Ubuntu:22.04:LTSlinux-hwe-6.5no fix listedUBUNTU-CVE-2022-49919
Ubuntu:22.04:LTSlinux-ibm5.15.0-1025.28UBUNTU-CVE-2022-49919
Ubuntu:22.04:LTSlinux-intel-iot-realtimeno fix listedUBUNTU-CVE-2022-49919
Ubuntu:22.04:LTSlinux-intel-iotg5.15.0-1025.30UBUNTU-CVE-2022-49919
Ubuntu:22.04:LTSlinux-kvm5.15.0-1028.33UBUNTU-CVE-2022-49919
Ubuntu:22.04:LTSlinux-lowlatency5.15.0-60.66UBUNTU-CVE-2022-49919
Ubuntu:22.04:LTSlinux-lowlatency-hwe-5.19no fix listedUBUNTU-CVE-2022-49919
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.2no fix listedUBUNTU-CVE-2022-49919
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.5no fix listedUBUNTU-CVE-2022-49919
Ubuntu:22.04:LTSlinux-nvidia5.15.0-1017.17UBUNTU-CVE-2022-49919
Ubuntu:22.04:LTSlinux-nvidia-6.2no fix listedUBUNTU-CVE-2022-49919
Ubuntu:22.04:LTSlinux-nvidia-6.5no fix listedUBUNTU-CVE-2022-49919
Ubuntu:22.04:LTSlinux-oem-5.17no fix listedUBUNTU-CVE-2022-49919
Ubuntu:22.04:LTSlinux-oem-6.0no fix listedUBUNTU-CVE-2022-49919
Ubuntu:22.04:LTSlinux-oem-6.1no fix listedUBUNTU-CVE-2022-49919
Ubuntu:22.04:LTSlinux-oem-6.5no fix listedUBUNTU-CVE-2022-49919
Ubuntu:22.04:LTSlinux-oracle5.15.0-1029.35UBUNTU-CVE-2022-49919
Ubuntu:22.04:LTSlinux-oracle-6.5no fix listedUBUNTU-CVE-2022-49919
Ubuntu:22.04:LTSlinux-raspi5.15.0-1024.26UBUNTU-CVE-2022-49919
Ubuntu:24.04:LTSlinux-raspi-realtimeno fix listedUBUNTU-CVE-2022-49919
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2022-49919
Ubuntu:24.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2022-49919
Ubuntu:22.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2022-49919
Ubuntu:22.04:LTSlinux-riscv-5.19no fix listedUBUNTU-CVE-2022-49919
Ubuntu:22.04:LTSlinux-riscv-6.5no fix listedUBUNTU-CVE-2022-49919
Ubuntu:22.04:LTSlinux-starfive-5.19no fix listedUBUNTU-CVE-2022-49919
Ubuntu:22.04:LTSlinux-starfive-6.2no fix listedUBUNTU-CVE-2022-49919
Ubuntu:22.04:LTSlinux-starfive-6.5no fix listedUBUNTU-CVE-2022-49919

Affected products (as reported)

VendorProductVersions
Linux Linux 5b8d63489c3b701eb2a76f848ec94d8cbc9373b9 – before 74fd5839467054cd9c4d050614d3ee8788386171330c0c6cd2150a2d7f47af16aa590078b0d2f736 – before b2d7a92aff0fbd93c29d2aa6451fb99f050e2c4ee33d9bd563e71f6c6528b96008d65524a459c4dc – before 6044791b7be707fd0e709f26e961a446424e50519dd732e0bdf538b1b76dc7c157e2b5e560ff30d3 – before 4ab6f96444e936f5e4a936d5c0bc948144bcded39dd732e0bdf538b1b76dc7c157e2b5e560ff30d3 – before 26b5934ff4194e13196bedcba373cd4915071d0e80de9ea1f5b808a6601e91111fae601df2b26369ab9f34a30c23f656e76f4c5b83125a4e7b53c86e5.4.198 – before 5.4.224
Linux Linux 5.19

Weakness: CWE-416 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References