Skip to content
fr Sign in
5.3 Medium Exploited

CVE-2022-2586 Linux Kernel Use-After-Free Vulnerability

Active exploitation observed

· CISA KEV catalogue
Required action Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.
Ransomware campaigns Not observed so far
Weakness CWE-416

Description

It was discovered that a nft object or expression could reference a nft set on a different nft table, leading to a use-after-free once that table was deleted.

Affected products and versions

Product Affected versions Fixed in
linux 5.19 5.19 → < 5.19.2 5.19.2
linux 5.16 5.16 → < 5.18.18 5.18.18
linux 5.11 5.11 → < 5.15.61 5.15.61
linux 5.5 5.5 → < 5.10.137 5.10.137
linux 4.20 4.20 → < 5.4.211 5.4.211
linux 4.15 4.15 → < 4.19.256 4.19.256
linux 3.16 3.16 → < 4.14.316 4.14.316
linux_kernel 6.0 earliest → < 6.0-rc1 6.0-rc1
SIMATIC S7-1500 TM MFP - GNU/Linux subsystem 1.1 earliest → < 1.1 1.1

References

Timeline

  1. Published
  2. Added to the KEV catalogue
  3. Last modified

Other CVEs of linux

The 7 CVEs of linux →
CVE-2023-6040 An out-of-bounds access vulnerability involving netfilter was reported and fixed as: f1082dd31fe4 (netfilter: nf_tables:… 7.8 High CVE-2021-3600 It was discovered that the eBPF implementation in the Linux kernel did not properly track bounds information for 32… 7.8 High CVE-2023-1032 The Linux kernel io_uring IORING_OP_SOCKET operation contained a double free in function __sys_socket_file() in file… 4.7 Medium CVE-2022-2602 io_uring UAF, Unix SCM garbage collection 5.3 Medium
Track this CVE