CVE-2022-48911

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2022-48911", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-08-21T06:06:23.294Z", "datePublished": "2024-08-22T01:31:07.463Z", "dateUpdated": "2026-08-05T08:52:51.573Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T08:52:51.573Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_queue: fix possible use-after-free\n\nEric Dumazet says:\n The sock_hold() side seems suspect, because there is no guarantee\n that sk_refcnt is not already 0.\n\nOn failure, we cannot queue the packet and need to indicate an\nerror. The packet will be dropped by the caller.\n\nv2: split skb prefetch hunk into separate change"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - Exploitation requires configuring NFQUEUE (nftables/iptables + nfnetlink_queue) and driving local socket lifecycle so packets hit __nf_queue with a dying state->sk; this is a local netfilter/netlink path, not a remote packet-only attack.\nAC:L - The attacker controls both sides of the race by installing NFQUEUE rules, running a queue listener, and racing connect/close (as in the TCP_NEW_SYN_RECV selftest), so success does not depend on external conditions.\nPR:L - Setting up nfnetlink/nftables NFQUEUE needs CAP_NET_ADMIN, but that capability is obtainable inside an unprivileged user+network namespace via netlink_net_capable against the netns user_ns.\nUI:N - No victim interaction is required; the attacker configures the queue, generates traffic, and closes sockets independently.\nS:U - Impact is kernel memory corruption / privilege escalation within the same host security authority, not a VM escape or cross-boundary breakout.\nC:H - Unsafe sock_hold() on a socket with sk_refcnt already 0 is a use-after-free of struct sock, which can be leveraged for arbitrary kernel memory disclosure.\nI:H - The same sock UAF enables heap reclaim/spray and corrupted socket lifetime handling (illegitimate refs and later sock_gen_put/sk_free paths), supporting arbitrary write / control-flow hijacking.\nA:H - The UAF reliably causes kernel oops/panic (refcount addition-on-0 and related free-path corruption), so availability impact is High."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["include/net/netfilter/nf_queue.h", "net/netfilter/nf_queue.c", "net/netfilter/nfnetlink_queue.c"], "versions": [{"version": "271b72c7fa82c2c7a795bc16896149933110672d", "lessThan": "21b27b2baa27423286e9b8d3f0b194d587083d95", "status": "affected", "versionType": "git"}, {"version": "271b72c7fa82c2c7a795bc16896149933110672d", "lessThan": "ef97921ccdc243170fcef857ba2a17cf697aece5", "status": "affected", "versionType": "git"}, {"version": "271b72c7fa82c2c7a795bc16896149933110672d", "lessThan": "34dc4a6a7f261736ef7183868a5bddad31c7f9e3", "status": "affected", "versionType": "git"}, {"version": "271b72c7fa82c2c7a795bc16896149933110672d", "lessThan": "43c25da41e3091b31a906651a43e80a2719aa1ff", "status": "affected", "versionType": "git"}, {"version": "271b72c7fa82c2c7a795bc16896149933110672d", "lessThan": "4d05239203fa38ea8a6f31e228460da4cb17a71a", "status": "affected", "versionType": "git"}, {"version": "271b72c7fa82c2c7a795bc16896149933110672d", "lessThan": "dd648bd1b33a828f62befa696b206c688da0ec43", "status": "affected", "versionType": "git"}, {"version": "271b72c7fa82c2c7a795bc16896149933110672d", "lessThan": "dcc3cb920bf7ba66ac5e9272293a9ba5f80917ee", "status": "affected", "versionType": "git"}, {"version": "271b72c7fa82c2c7a795bc16896149933110672d", "lessThan": "c3873070247d9e3c7a6b0cf9bf9b45e8018427b1", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["include/net/netfilter/nf_queue.h", "net/netfilter/nf_queue.c", "net/netfilter/nfnetlink_queue.c"], "versions": [{"version": "2.6.29", "status": "affected"}, {"version": "0", "lessThan": "2.6.29", "status": "unaffected", "versionType": "semver"}, {"version": "4.9.305", "lessThanOrEqual": "4.9.*", "status": "unaffected", "versionType": "semver"}, {"version": "4.14.270", "lessThanOrEqual": "4.14.*", "status": "unaffected", "versionType": "semver"}, {"version": "4.19.233", "lessThanOrEqual": "4.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.4.183", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.104", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.27", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.16.13", "lessThanOrEqual": "5.16.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.17", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.29", "versionEndExcluding": "4.9.305"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.29", "versionEndExcluding": "4.14.270"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.29", "versionEndExcluding": "4.19.233"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.29", "versionEndExcluding": "5.4.183"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.29", "versionEndExcluding": "5.10.104"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.29", "versionEndExcluding": "5.15.27"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.29", "versionEndExcluding": "5.16.13"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.29", "versionEndExcluding": "5.17"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/21b27b2baa27423286e9b8d3f0b194d587083d95"}, {"url": "https://git.kernel.org/stable/c/ef97921ccdc243170fcef857ba2a17cf697aece5"}, {"url": "https://git.kernel.org/stable/c/34dc4a6a7f261736ef7183868a5bddad31c7f9e3"}, {"url": "https://git.kernel.org/stable/c/43c25da41e3091b31a906651a43e80a2719aa1ff"}, {"url": "https://git.kernel.org/stable/c/4d05239203fa38ea8a6f31e228460da4cb17a71a"}, {"url": "https://git.kernel.org/stable/c/dd648bd1b33a828f62befa696b206c688da0ec43"}, {"url": "https://git.kernel.org/stable/c/dcc3cb920bf7ba66ac5e9272293a9ba5f80917ee"}, {"url": "https://git.kernel.org/stable/c/c3873070247d9e3c7a6b0cf9bf9b45e8018427b1"}], "title": "netfilter: nf_queue: fix possible use-after-free", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2022-48911", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T15:34:00.950489Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-12T17:33:02.033Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2022-48911", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T15:34:00.950489Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T12:42:12.865Z"}}], "cna": {"title": "netfilter: nf_queue: fix possible use-after-free", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - Exploitation requires configuring NFQUEUE (nftables/iptables + nfnetlink_queue) and driving local socket lifecycle so packets hit __nf_queue with a dying state->sk; this is a local netfilter/netlink path, not a remote packet-only attack.\nAC:L - The attacker controls both sides of the race by installing NFQUEUE rules, running a queue listener, and racing connect/close (as in the TCP_NEW_SYN_RECV selftest), so success does not depend on external conditions.\nPR:L - Setting up nfnetlink/nftables NFQUEUE needs CAP_NET_ADMIN, but that capability is obtainable inside an unprivileged user+network namespace via netlink_net_capable against the netns user_ns.\nUI:N - No victim interaction is required; the attacker configures the queue, generates traffic, and closes sockets independently.\nS:U - Impact is kernel memory corruption / privilege escalation within the same host security authority, not a VM escape or cross-boundary breakout.\nC:H - Unsafe sock_hold() on a socket with sk_refcnt already 0 is a use-after-free of struct sock, which can be leveraged for arbitrary kernel memory disclosure.\nI:H - The same sock UAF enables heap reclaim/spray and corrupted socket lifetime handling (illegitimate refs and later sock_gen_put/sk_free paths), supporting arbitrary write / control-flow hijacking.\nA:H - The UAF reliably causes kernel oops/panic (refcount addition-on-0 and related free-path corruption), so availability impact is High."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "271b72c7fa82c2c7a795bc16896149933110672d", "lessThan": "21b27b2baa27423286e9b8d3f0b194d587083d95", "versionType": "git"}, {"status": "affected", "version": "271b72c7fa82c2c7a795bc16896149933110672d", "lessThan": "ef97921ccdc243170fcef857ba2a17cf697aece5", "versionType": "git"}, {"status": "affected", "version": "271b72c7fa82c2c7a795bc16896149933110672d", "lessThan": "34dc4a6a7f261736ef7183868a5bddad31c7f9e3", "versionType": "git"}, {"status": "affected", "version": "271b72c7fa82c2c7a795bc16896149933110672d", "lessThan": "43c25da41e3091b31a906651a43e80a2719aa1ff", "versionType": "git"}, {"status": "affected", "version": "271b72c7fa82c2c7a795bc16896149933110672d", "lessThan": "4d05239203fa38ea8a6f31e228460da4cb17a71a", "versionType": "git"}, {"status": "affected", "version": "271b72c7fa82c2c7a795bc16896149933110672d", "lessThan": "dd648bd1b33a828f62befa696b206c688da0ec43", "versionType": "git"}, {"status": "affected", "version": "271b72c7fa82c2c7a795bc16896149933110672d", "lessThan": "dcc3cb920bf7ba66ac5e9272293a9ba5f80917ee", "versionType": "git"}, {"status": "affected", "version": "271b72c7fa82c2c7a795bc16896149933110672d", "lessThan": "c3873070247d9e3c7a6b0cf9bf9b45e8018427b1", "versionType": "git"}], "programFiles": ["include/net/netfilter/nf_queue.h", "net/netfilter/nf_queue.c", "net/netfilter/nfnetlink_queue.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "2.6.29"}, {"status": "unaffected", "version": "0", "lessThan": "2.6.29", "versionType": "semver"}, {"status": "unaffected", "version": "4.9.305", "versionType": "semver", "lessThanOrEqual": "4.9.*"}, {"status": "unaffected", "version": "4.14.270", "versionType": "semver", "lessThanOrEqual": "4.14.*"}, {"status": "unaffected", "version": "4.19.233", "versionType": "semver", "lessThanOrEqual": "4.19.*"}, {"status": "unaffected", "version": "5.4.183", "versionType": "semver", "lessThanOrEqual": "5.4.*"}, {"status": "unaffected", "version": "5.10.104", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.27", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "5.16.13", "versionType": "semver", "lessThanOrEqual": "5.16.*"}, {"status": "unaffected", "version": "5.17", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["include/net/netfilter/nf_queue.h", "net/netfilter/nf_queue.c", "net/netfilter/nfnetlink_queue.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/21b27b2baa27423286e9b8d3f0b194d587083d95"}, {"url": "https://git.kernel.org/stable/c/ef97921ccdc243170fcef857ba2a17cf697aece5"}, {"url": "https://git.kernel.org/stable/c/34dc4a6a7f261736ef7183868a5bddad31c7f9e3"}, {"url": "https://git.kernel.org/stable/c/43c25da41e3091b31a906651a43e80a2719aa1ff"}, {"url": "https://git.kernel.org/stable/c/4d05239203fa38ea8a6f31e228460da4cb17a71a"}, {"url": "https://git.kernel.org/stable/c/dd648bd1b33a828f62befa696b206c688da0ec43"}, {"url": "https://git.kernel.org/stable/c/dcc3cb920bf7ba66ac5e9272293a9ba5f80917ee"}, {"url": "https://git.kernel.org/stable/c/c3873070247d9e3c7a6b0cf9bf9b45e8018427b1"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_queue: fix possible use-after-free\n\nEric Dumazet says:\n The sock_hold() side seems suspect, because there is no guarantee\n that sk_refcnt is not already 0.\n\nOn failure, we cannot queue the packet and need to indicate an\nerror. The packet will be dropped by the caller.\n\nv2: split skb prefetch hunk into separate change"}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "4.9.305", "versionStartIncluding": "2.6.29"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "4.14.270", "versionStartIncluding": "2.6.29"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "4.19.233", "versionStartIncluding": "2.6.29"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.4.183", "versionStartIncluding": "2.6.29"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.104", "versionStartIncluding": "2.6.29"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.27", "versionStartIncluding": "2.6.29"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.16.13", "versionStartIncluding": "2.6.29"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.17", "versionStartIncluding": "2.6.29"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T08:52:51.573Z"}}}, "cveMetadata": {"cveId": "CVE-2022-48911", "state": "PUBLISHED", "dateUpdated": "2026-08-05T08:52:51.573Z", "dateReserved": "2024-08-21T06:06:23.294Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-08-22T01:31:07.463Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["include/net/netfilter/nf_queue.h", "net/netfilter/nf_queue.c", "net/netfilter/nfnetlink_queue.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "21b27b2baa27423286e9b8d3f0b194d587083d95", "status": "affected", "version": "271b72c7fa82c2c7a795bc16896149933110672d", "versionType": "git"}, {"lessThan": "ef97921ccdc243170fcef857ba2a17cf697aece5", "status": "affected", "version": "271b72c7fa82c2c7a795bc16896149933110672d", "versionType": "git"}, {"lessThan": "34dc4a6a7f261736ef7183868a5bddad31c7f9e3", "status": "affected", "version": "271b72c7fa82c2c7a795bc16896149933110672d", "versionType": "git"}, {"lessThan": "43c25da41e3091b31a906651a43e80a2719aa1ff", "status": "affected", "version": "271b72c7fa82c2c7a795bc16896149933110672d", "versionType": "git"}, {"lessThan": "4d05239203fa38ea8a6f31e228460da4cb17a71a", "status": "affected", "version": "271b72c7fa82c2c7a795bc16896149933110672d", "versionType": "git"}, {"lessThan": "dd648bd1b33a828f62befa696b206c688da0ec43", "status": "affected", "version": "271b72c7fa82c2c7a795bc16896149933110672d", "versionType": "git"}, {"lessThan": "dcc3cb920bf7ba66ac5e9272293a9ba5f80917ee", "status": "affected", "version": "271b72c7fa82c2c7a795bc16896149933110672d", "versionType": "git"}, {"lessThan": "c3873070247d9e3c7a6b0cf9bf9b45e8018427b1", "status": "affected", "version": "271b72c7fa82c2c7a795bc16896149933110672d", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["include/net/netfilter/nf_queue.h", "net/netfilter/nf_queue.c", "net/netfilter/nfnetlink_queue.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "2.6.29"}, {"lessThan": "2.6.29", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "4.9.*", "status": "unaffected", "version": "4.9.305", "versionType": "semver"}, {"lessThanOrEqual": "4.14.*", "status": "unaffected", "version": "4.14.270", "versionType": "semver"}, {"lessThanOrEqual": "4.19.*", "status": "unaffected", "version": "4.19.233", "versionType": "semver"}, {"lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.183", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.104", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.27", "versionType": "semver"}, {"lessThanOrEqual": "5.16.*", "status": "unaffected", "version": "5.16.13", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "5.17", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "C3F18B92-FE18-47E9-A7F2-16F95AB41486", "versionEndExcluding": "4.9.305", "versionStartIncluding": "2.6.29", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "51C0B6F2-A904-4FE6-B06B-CE26226B22B7", "versionEndExcluding": "4.14.270", "versionStartIncluding": "4.10", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "B59A7E33-6262-458E-AC76-E8CC4E812344", "versionEndExcluding": "4.19.233", "versionStartIncluding": "4.15", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "76A7616E-E6B9-4A7F-AA7C-1D47F774215F", "versionEndExcluding": "5.4.183", "versionStartIncluding": "4.20", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "764998FC-D1F7-4BAA-BD56-A553C7AB8F08", "versionEndExcluding": "5.10.104", "versionStartIncluding": "5.5", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "B3A8E092-3021-4A34-8DCE-B89D2238818B", "versionEndExcluding": "5.15.27", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "B871B667-EDC0-435D-909E-E918D8D90995", "versionEndExcluding": "5.16.13", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:5.17:rc1:*:*:*:*:*:*", "matchCriteriaId": "7BD5F8D9-54FA-4CB0-B4F0-CB0471FDDB2D", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:5.17:rc2:*:*:*:*:*:*", "matchCriteriaId": "E6E34B23-78B4-4516-9BD8-61B33F4AC49A", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:5.17:rc3:*:*:*:*:*:*", "matchCriteriaId": "C030FA3D-03F4-4FB9-9DBF-D08E5CAC51AA", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:5.17:rc4:*:*:*:*:*:*", "matchCriteriaId": "B2D2677C-5389-4AE9-869D-0F881E80D923", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:5.17:rc5:*:*:*:*:*:*", "matchCriteriaId": "EFA3917C-C322-4D92-912D-ECE45B2E7416", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:5.17:rc6:*:*:*:*:*:*", "matchCriteriaId": "BED18363-5ABC-4639-8BBA-68E771E5BB3F", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_queue: fix possible use-after-free\n\nEric Dumazet says:\n The sock_hold() side seems suspect, because there is no guarantee\n that sk_refcnt is not already 0.\n\nOn failure, we cannot queue the packet and need to indicate an\nerror. The packet will be dropped by the caller.\n\nv2: split skb prefetch hunk into separate change"}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: netfilter: nf_queue: corrige posible use-after-free Eric Dumazet dice: El lado sock_hold() parece sospechoso, porque no hay garant\u00eda de que sk_refcnt no sea ya 0. En caso de falla, No podemos poner en cola el paquete y necesitamos indicar un error. La persona que llama descartar\u00e1 el paquete. v2: dividir el fragmento de captaci\u00f3n previa de skb en un cambio separado"}], "id": "CVE-2022-48911", "lastModified": "2026-08-04T10:17:25.913", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2022-48911", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-09-10T15:34:00.950489Z", "version": "2.0.3"}}]}, "published": "2024-08-22T02:15:05.483", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/21b27b2baa27423286e9b8d3f0b194d587083d95"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/34dc4a6a7f261736ef7183868a5bddad31c7f9e3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/43c25da41e3091b31a906651a43e80a2719aa1ff"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/4d05239203fa38ea8a6f31e228460da4cb17a71a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/c3873070247d9e3c7a6b0cf9bf9b45e8018427b1"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/dcc3cb920bf7ba66ac5e9272293a9ba5f80917ee"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/dd648bd1b33a828f62befa696b206c688da0ec43"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ef97921ccdc243170fcef857ba2a17cf697aece5"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: netfilter: netfilter: nf_queue: fix possible use-after-free", "id": "2307164", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2307164"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-416", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nnetfilter: nf_queue: fix possible use-after-free\nEric Dumazet says:\nThe sock_hold() side seems suspect, because there is no guarantee\nthat sk_refcnt is not already 0.\nOn failure, we cannot queue the packet and need to indicate an\nerror. The packet will be dropped by the caller.\nv2: split skb prefetch hunk into separate change", "A use-after-free flaw was found in the Linux kernel's NetFilter functionality. This issue could allow a local user to crash the system or escalate their privileges on the system."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2022-48911", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Will not fix", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-08-22T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2022-48911\nhttps://nvd.nist.gov/vuln/detail/CVE-2022-48911\nhttps://lore.kernel.org/linux-cve-announce/2024082215-CVE-2022-48911-45bc@gregkh/T"], "statement": "Only Red Hat Enterprise Linux 8 is affected.", "threat_severity": "Moderate"}

{}