GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2022-48911 (GCVE-0-2022-48911)

Vulnerability from cvelistv5 – Published: 2024-08-22 01:31 – Updated: 2026-08-05 08:52
VLAI
Title
netfilter: nf_queue: fix possible use-after-free
Summary
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_queue: fix possible use-after-free Eric Dumazet says: The sock_hold() side seems suspect, because there is no guarantee that sk_refcnt is not already 0. On failure, we cannot queue the packet and need to indicate an error. The packet will be dropped by the caller. v2: split skb prefetch hunk into separate change
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-10 15:34 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 271b72c7fa82c2c7a795bc16896149933110672d , < 21b27b2baa27423286e9b8d3f0b194d587083d95 (git)
Affected: 271b72c7fa82c2c7a795bc16896149933110672d , < ef97921ccdc243170fcef857ba2a17cf697aece5 (git)
Affected: 271b72c7fa82c2c7a795bc16896149933110672d , < 34dc4a6a7f261736ef7183868a5bddad31c7f9e3 (git)
Affected: 271b72c7fa82c2c7a795bc16896149933110672d , < 43c25da41e3091b31a906651a43e80a2719aa1ff (git)
Affected: 271b72c7fa82c2c7a795bc16896149933110672d , < 4d05239203fa38ea8a6f31e228460da4cb17a71a (git)
Affected: 271b72c7fa82c2c7a795bc16896149933110672d , < dd648bd1b33a828f62befa696b206c688da0ec43 (git)
Affected: 271b72c7fa82c2c7a795bc16896149933110672d , < dcc3cb920bf7ba66ac5e9272293a9ba5f80917ee (git)
Affected: 271b72c7fa82c2c7a795bc16896149933110672d , < c3873070247d9e3c7a6b0cf9bf9b45e8018427b1 (git)
guessed Create a notification for this product.
Linux Linux Affected: 2.6.29
Unaffected: 0 , < 2.6.29 (semver)
Unaffected: 4.9.305 , ≤ 4.9.* (semver)
Unaffected: 4.14.270 , ≤ 4.14.* (semver)
Unaffected: 4.19.233 , ≤ 4.19.* (semver)
Unaffected: 5.4.183 , ≤ 5.4.* (semver)
Unaffected: 5.10.104 , ≤ 5.10.* (semver)
Unaffected: 5.15.27 , ≤ 5.15.* (semver)
Unaffected: 5.16.13 , ≤ 5.16.* (semver)
Unaffected: 5.17 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-48911",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T15:34:00.950489Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-12T17:33:02.033Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/net/netfilter/nf_queue.h",
            "net/netfilter/nf_queue.c",
            "net/netfilter/nfnetlink_queue.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "21b27b2baa27423286e9b8d3f0b194d587083d95",
              "status": "affected",
              "version": "271b72c7fa82c2c7a795bc16896149933110672d",
              "versionType": "git"
            },
            {
              "lessThan": "ef97921ccdc243170fcef857ba2a17cf697aece5",
              "status": "affected",
              "version": "271b72c7fa82c2c7a795bc16896149933110672d",
              "versionType": "git"
            },
            {
              "lessThan": "34dc4a6a7f261736ef7183868a5bddad31c7f9e3",
              "status": "affected",
              "version": "271b72c7fa82c2c7a795bc16896149933110672d",
              "versionType": "git"
            },
            {
              "lessThan": "43c25da41e3091b31a906651a43e80a2719aa1ff",
              "status": "affected",
              "version": "271b72c7fa82c2c7a795bc16896149933110672d",
              "versionType": "git"
            },
            {
              "lessThan": "4d05239203fa38ea8a6f31e228460da4cb17a71a",
              "status": "affected",
              "version": "271b72c7fa82c2c7a795bc16896149933110672d",
              "versionType": "git"
            },
            {
              "lessThan": "dd648bd1b33a828f62befa696b206c688da0ec43",
              "status": "affected",
              "version": "271b72c7fa82c2c7a795bc16896149933110672d",
              "versionType": "git"
            },
            {
              "lessThan": "dcc3cb920bf7ba66ac5e9272293a9ba5f80917ee",
              "status": "affected",
              "version": "271b72c7fa82c2c7a795bc16896149933110672d",
              "versionType": "git"
            },
            {
              "lessThan": "c3873070247d9e3c7a6b0cf9bf9b45e8018427b1",
              "status": "affected",
              "version": "271b72c7fa82c2c7a795bc16896149933110672d",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/net/netfilter/nf_queue.h",
            "net/netfilter/nf_queue.c",
            "net/netfilter/nfnetlink_queue.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.29"
            },
            {
              "lessThan": "2.6.29",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.9.*",
              "status": "unaffected",
              "version": "4.9.305",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.14.*",
              "status": "unaffected",
              "version": "4.14.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.233",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.104",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.27",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.16.*",
              "status": "unaffected",
              "version": "5.16.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.9.305",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.14.270",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.233",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.183",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.104",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.27",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.16.13",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.17",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_queue: fix possible use-after-free\n\nEric Dumazet says:\n  The sock_hold() side seems suspect, because there is no guarantee\n  that sk_refcnt is not already 0.\n\nOn failure, we cannot queue the packet and need to indicate an\nerror.  The packet will be dropped by the caller.\n\nv2: split skb prefetch hunk into separate change"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires configuring NFQUEUE (nftables/iptables + nfnetlink_queue) and driving local socket lifecycle so packets hit __nf_queue with a dying state-\u003esk; this is a local netfilter/netlink path, not a remote packet-only attack.\nAC:L - The attacker controls both sides of the race by installing NFQUEUE rules, running a queue listener, and racing connect/close (as in the TCP_NEW_SYN_RECV selftest), so success does not depend on external conditions.\nPR:L - Setting up nfnetlink/nftables NFQUEUE needs CAP_NET_ADMIN, but that capability is obtainable inside an unprivileged user+network namespace via netlink_net_capable against the netns user_ns.\nUI:N - No victim interaction is required; the attacker configures the queue, generates traffic, and closes sockets independently.\nS:U - Impact is kernel memory corruption / privilege escalation within the same host security authority, not a VM escape or cross-boundary breakout.\nC:H - Unsafe sock_hold() on a socket with sk_refcnt already 0 is a use-after-free of struct sock, which can be leveraged for arbitrary kernel memory disclosure.\nI:H - The same sock UAF enables heap reclaim/spray and corrupted socket lifetime handling (illegitimate refs and later sock_gen_put/sk_free paths), supporting arbitrary write / control-flow hijacking.\nA:H - The UAF reliably causes kernel oops/panic (refcount addition-on-0 and related free-path corruption), so availability impact is High."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:52:51.573Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/21b27b2baa27423286e9b8d3f0b194d587083d95"
        },
        {
          "url": "https://git.kernel.org/stable/c/ef97921ccdc243170fcef857ba2a17cf697aece5"
        },
        {
          "url": "https://git.kernel.org/stable/c/34dc4a6a7f261736ef7183868a5bddad31c7f9e3"
        },
        {
          "url": "https://git.kernel.org/stable/c/43c25da41e3091b31a906651a43e80a2719aa1ff"
        },
        {
          "url": "https://git.kernel.org/stable/c/4d05239203fa38ea8a6f31e228460da4cb17a71a"
        },
        {
          "url": "https://git.kernel.org/stable/c/dd648bd1b33a828f62befa696b206c688da0ec43"
        },
        {
          "url": "https://git.kernel.org/stable/c/dcc3cb920bf7ba66ac5e9272293a9ba5f80917ee"
        },
        {
          "url": "https://git.kernel.org/stable/c/c3873070247d9e3c7a6b0cf9bf9b45e8018427b1"
        }
      ],
      "title": "netfilter: nf_queue: fix possible use-after-free",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-48911",
    "datePublished": "2024-08-22T01:31:07.463Z",
    "dateReserved": "2024-08-21T06:06:23.294Z",
    "dateUpdated": "2026-08-05T08:52:51.573Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-48911",
      "date": "2026-09-18",
      "epss": "0.00215",
      "percentile": "0.12241"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "include/net/netfilter/nf_queue.h",
                  "net/netfilter/nf_queue.c",
                  "net/netfilter/nfnetlink_queue.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "21b27b2baa27423286e9b8d3f0b194d587083d95",
                    "status": "affected",
                    "version": "271b72c7fa82c2c7a795bc16896149933110672d",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "ef97921ccdc243170fcef857ba2a17cf697aece5",
                    "status": "affected",
                    "version": "271b72c7fa82c2c7a795bc16896149933110672d",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "34dc4a6a7f261736ef7183868a5bddad31c7f9e3",
                    "status": "affected",
                    "version": "271b72c7fa82c2c7a795bc16896149933110672d",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "43c25da41e3091b31a906651a43e80a2719aa1ff",
                    "status": "affected",
                    "version": "271b72c7fa82c2c7a795bc16896149933110672d",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "4d05239203fa38ea8a6f31e228460da4cb17a71a",
                    "status": "affected",
                    "version": "271b72c7fa82c2c7a795bc16896149933110672d",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "dd648bd1b33a828f62befa696b206c688da0ec43",
                    "status": "affected",
                    "version": "271b72c7fa82c2c7a795bc16896149933110672d",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "dcc3cb920bf7ba66ac5e9272293a9ba5f80917ee",
                    "status": "affected",
                    "version": "271b72c7fa82c2c7a795bc16896149933110672d",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "c3873070247d9e3c7a6b0cf9bf9b45e8018427b1",
                    "status": "affected",
                    "version": "271b72c7fa82c2c7a795bc16896149933110672d",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "include/net/netfilter/nf_queue.h",
                  "net/netfilter/nf_queue.c",
                  "net/netfilter/nfnetlink_queue.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "2.6.29"
                  },
                  {
                    "lessThan": "2.6.29",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "4.9.*",
                    "status": "unaffected",
                    "version": "4.9.305",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "4.14.*",
                    "status": "unaffected",
                    "version": "4.14.270",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "4.19.*",
                    "status": "unaffected",
                    "version": "4.19.233",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.4.*",
                    "status": "unaffected",
                    "version": "5.4.183",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.104",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.27",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.16.*",
                    "status": "unaffected",
                    "version": "5.16.13",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "5.17",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "C3F18B92-FE18-47E9-A7F2-16F95AB41486",
                    "versionEndExcluding": "4.9.305",
                    "versionStartIncluding": "2.6.29",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "51C0B6F2-A904-4FE6-B06B-CE26226B22B7",
                    "versionEndExcluding": "4.14.270",
                    "versionStartIncluding": "4.10",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "B59A7E33-6262-458E-AC76-E8CC4E812344",
                    "versionEndExcluding": "4.19.233",
                    "versionStartIncluding": "4.15",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "76A7616E-E6B9-4A7F-AA7C-1D47F774215F",
                    "versionEndExcluding": "5.4.183",
                    "versionStartIncluding": "4.20",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "764998FC-D1F7-4BAA-BD56-A553C7AB8F08",
                    "versionEndExcluding": "5.10.104",
                    "versionStartIncluding": "5.5",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "B3A8E092-3021-4A34-8DCE-B89D2238818B",
                    "versionEndExcluding": "5.15.27",
                    "versionStartIncluding": "5.11",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "B871B667-EDC0-435D-909E-E918D8D90995",
                    "versionEndExcluding": "5.16.13",
                    "versionStartIncluding": "5.16",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:5.17:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "7BD5F8D9-54FA-4CB0-B4F0-CB0471FDDB2D",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:5.17:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "E6E34B23-78B4-4516-9BD8-61B33F4AC49A",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:5.17:rc3:*:*:*:*:*:*",
                    "matchCriteriaId": "C030FA3D-03F4-4FB9-9DBF-D08E5CAC51AA",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:5.17:rc4:*:*:*:*:*:*",
                    "matchCriteriaId": "B2D2677C-5389-4AE9-869D-0F881E80D923",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:5.17:rc5:*:*:*:*:*:*",
                    "matchCriteriaId": "EFA3917C-C322-4D92-912D-ECE45B2E7416",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:5.17:rc6:*:*:*:*:*:*",
                    "matchCriteriaId": "BED18363-5ABC-4639-8BBA-68E771E5BB3F",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_queue: fix possible use-after-free\n\nEric Dumazet says:\n  The sock_hold() side seems suspect, because there is no guarantee\n  that sk_refcnt is not already 0.\n\nOn failure, we cannot queue the packet and need to indicate an\nerror.  The packet will be dropped by the caller.\n\nv2: split skb prefetch hunk into separate change"
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: netfilter: nf_queue: corrige posible use-after-free Eric Dumazet dice: El lado sock_hold() parece sospechoso, porque no hay garant\u00eda de que sk_refcnt no sea ya 0. En caso de falla, No podemos poner en cola el paquete y necesitamos indicar un error. La persona que llama descartar\u00e1 el paquete. v2: dividir el fragmento de captaci\u00f3n previa de skb en un cambio separado"
          }
        ],
        "id": "CVE-2022-48911",
        "lastModified": "2026-08-04T10:17:25.913",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2022-48911",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T15:34:00.950489Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-08-22T02:15:05.483",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/21b27b2baa27423286e9b8d3f0b194d587083d95"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/34dc4a6a7f261736ef7183868a5bddad31c7f9e3"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/43c25da41e3091b31a906651a43e80a2719aa1ff"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/4d05239203fa38ea8a6f31e228460da4cb17a71a"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/c3873070247d9e3c7a6b0cf9bf9b45e8018427b1"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/dcc3cb920bf7ba66ac5e9272293a9ba5f80917ee"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/dd648bd1b33a828f62befa696b206c688da0ec43"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/ef97921ccdc243170fcef857ba2a17cf697aece5"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-416"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T19:47:17+00:00",
      "cve": "CVE-2022-48911",
      "id": "CVE-2022-48911",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:known_affected": "16",
      "product_status:known_not_affected": "182",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: netfilter: netfilter: nf_queue: fix possible use-after-free",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-48911.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2022-48911",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-09-10T15:34:00.950489Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-09-11T12:42:12.865Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "include/net/netfilter/nf_queue.h",
                "net/netfilter/nf_queue.c",
                "net/netfilter/nfnetlink_queue.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "21b27b2baa27423286e9b8d3f0b194d587083d95",
                  "status": "affected",
                  "version": "271b72c7fa82c2c7a795bc16896149933110672d",
                  "versionType": "git"
                },
                {
                  "lessThan": "ef97921ccdc243170fcef857ba2a17cf697aece5",
                  "status": "affected",
                  "version": "271b72c7fa82c2c7a795bc16896149933110672d",
                  "versionType": "git"
                },
                {
                  "lessThan": "34dc4a6a7f261736ef7183868a5bddad31c7f9e3",
                  "status": "affected",
                  "version": "271b72c7fa82c2c7a795bc16896149933110672d",
                  "versionType": "git"
                },
                {
                  "lessThan": "43c25da41e3091b31a906651a43e80a2719aa1ff",
                  "status": "affected",
                  "version": "271b72c7fa82c2c7a795bc16896149933110672d",
                  "versionType": "git"
                },
                {
                  "lessThan": "4d05239203fa38ea8a6f31e228460da4cb17a71a",
                  "status": "affected",
                  "version": "271b72c7fa82c2c7a795bc16896149933110672d",
                  "versionType": "git"
                },
                {
                  "lessThan": "dd648bd1b33a828f62befa696b206c688da0ec43",
                  "status": "affected",
                  "version": "271b72c7fa82c2c7a795bc16896149933110672d",
                  "versionType": "git"
                },
                {
                  "lessThan": "dcc3cb920bf7ba66ac5e9272293a9ba5f80917ee",
                  "status": "affected",
                  "version": "271b72c7fa82c2c7a795bc16896149933110672d",
                  "versionType": "git"
                },
                {
                  "lessThan": "c3873070247d9e3c7a6b0cf9bf9b45e8018427b1",
                  "status": "affected",
                  "version": "271b72c7fa82c2c7a795bc16896149933110672d",
                  "versionType": "git"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "include/net/netfilter/nf_queue.h",
                "net/netfilter/nf_queue.c",
                "net/netfilter/nfnetlink_queue.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "2.6.29"
                },
                {
                  "lessThan": "2.6.29",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "4.9.*",
                  "status": "unaffected",
                  "version": "4.9.305",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "4.14.*",
                  "status": "unaffected",
                  "version": "4.14.270",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "4.19.*",
                  "status": "unaffected",
                  "version": "4.19.233",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.4.*",
                  "status": "unaffected",
                  "version": "5.4.183",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.10.*",
                  "status": "unaffected",
                  "version": "5.10.104",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.15.*",
                  "status": "unaffected",
                  "version": "5.15.27",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.16.*",
                  "status": "unaffected",
                  "version": "5.16.13",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "5.17",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "4.9.305",
                      "versionStartIncluding": "2.6.29",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "4.14.270",
                      "versionStartIncluding": "2.6.29",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "4.19.233",
                      "versionStartIncluding": "2.6.29",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.4.183",
                      "versionStartIncluding": "2.6.29",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.10.104",
                      "versionStartIncluding": "2.6.29",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.15.27",
                      "versionStartIncluding": "2.6.29",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.16.13",
                      "versionStartIncluding": "2.6.29",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.17",
                      "versionStartIncluding": "2.6.29",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_queue: fix possible use-after-free\n\nEric Dumazet says:\n  The sock_hold() side seems suspect, because there is no guarantee\n  that sk_refcnt is not already 0.\n\nOn failure, we cannot queue the packet and need to indicate an\nerror.  The packet will be dropped by the caller.\n\nv2: split skb prefetch hunk into separate change"
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "scenarios": [
                {
                  "lang": "en",
                  "value": "AV:L - Exploitation requires configuring NFQUEUE (nftables/iptables + nfnetlink_queue) and driving local socket lifecycle so packets hit __nf_queue with a dying state-\u003esk; this is a local netfilter/netlink path, not a remote packet-only attack.\nAC:L - The attacker controls both sides of the race by installing NFQUEUE rules, running a queue listener, and racing connect/close (as in the TCP_NEW_SYN_RECV selftest), so success does not depend on external conditions.\nPR:L - Setting up nfnetlink/nftables NFQUEUE needs CAP_NET_ADMIN, but that capability is obtainable inside an unprivileged user+network namespace via netlink_net_capable against the netns user_ns.\nUI:N - No victim interaction is required; the attacker configures the queue, generates traffic, and closes sockets independently.\nS:U - Impact is kernel memory corruption / privilege escalation within the same host security authority, not a VM escape or cross-boundary breakout.\nC:H - Unsafe sock_hold() on a socket with sk_refcnt already 0 is a use-after-free of struct sock, which can be leveraged for arbitrary kernel memory disclosure.\nI:H - The same sock UAF enables heap reclaim/spray and corrupted socket lifetime handling (illegitimate refs and later sock_gen_put/sk_free paths), supporting arbitrary write / control-flow hijacking.\nA:H - The UAF reliably causes kernel oops/panic (refcount addition-on-0 and related free-path corruption), so availability impact is High."
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-05T08:52:51.573Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/21b27b2baa27423286e9b8d3f0b194d587083d95"
            },
            {
              "url": "https://git.kernel.org/stable/c/ef97921ccdc243170fcef857ba2a17cf697aece5"
            },
            {
              "url": "https://git.kernel.org/stable/c/34dc4a6a7f261736ef7183868a5bddad31c7f9e3"
            },
            {
              "url": "https://git.kernel.org/stable/c/43c25da41e3091b31a906651a43e80a2719aa1ff"
            },
            {
              "url": "https://git.kernel.org/stable/c/4d05239203fa38ea8a6f31e228460da4cb17a71a"
            },
            {
              "url": "https://git.kernel.org/stable/c/dd648bd1b33a828f62befa696b206c688da0ec43"
            },
            {
              "url": "https://git.kernel.org/stable/c/dcc3cb920bf7ba66ac5e9272293a9ba5f80917ee"
            },
            {
              "url": "https://git.kernel.org/stable/c/c3873070247d9e3c7a6b0cf9bf9b45e8018427b1"
            }
          ],
          "title": "netfilter: nf_queue: fix possible use-after-free",
          "x_generator": {
            "engine": "bippy-1.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2022-48911",
        "datePublished": "2024-08-22T01:31:07.463Z",
        "dateReserved": "2024-08-21T06:06:23.294Z",
        "dateUpdated": "2026-08-05T08:52:51.573Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.