CVE-2022-2586

medium · 5.3Actively exploited

On the CISA Known Exploited Vulnerabilities catalog

Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.

Added 2024-06-26Remediation due 2024-07-17

It was discovered that a nft object or expression could reference a nft set on a different nft table, leading to a use-after-free once that table was deleted.

5.3

CVSS

10.5%

EPSS (exploit prob.)

96th

EPSS percentile

2024-01-08

Published

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H

Weaknesses

CWE-416

Affected products

Vendor	Product	Affected versions
linux	linux_kernel	>= 3.16, < 4.14.316
linux	linux_kernel	>= 4.15, < 4.19.256
linux	linux_kernel	>= 4.20, < 5.4.211
linux	linux_kernel	>= 5.5, < 5.10.137
linux	linux_kernel	>= 5.11, < 5.15.61
linux	linux_kernel	>= 5.16, < 5.18.18
linux	linux_kernel	>= 5.19, < 5.19.2
canonical	ubuntu_linux	14.04
canonical	ubuntu_linux	16.04
canonical	ubuntu_linux	18.04
canonical	ubuntu_linux	20.04
canonical	ubuntu_linux	22.04

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2022-2586