GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2022-50000 (GCVE-0-2022-50000)

Vulnerability from cvelistv5 – Published: 2025-06-18 11:00 – Updated: 2026-08-05 08:57
VLAI
Title
netfilter: flowtable: fix stuck flows on cleanup due to pending work
Summary
In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: fix stuck flows on cleanup due to pending work To clear the flow table on flow table free, the following sequence normally happens in order: 1) gc_step work is stopped to disable any further stats/del requests. 2) All flow table entries are set to teardown state. 3) Run gc_step which will queue HW del work for each flow table entry. 4) Waiting for the above del work to finish (flush). 5) Run gc_step again, deleting all entries from the flow table. 6) Flow table is freed. But if a flow table entry already has pending HW stats or HW add work step 3 will not queue HW del work (it will be skipped), step 4 will wait for the pending add/stats to finish, and step 5 will queue HW del work which might execute after freeing of the flow table. To fix the above, this patch flushes the pending work, then it sets the teardown flag to all flows in the flowtable and it forces a garbage collector run to queue work to remove the flows from hardware, then it flushes this new pending work and (finally) it forces another garbage collector run to remove the entry from the software flowtable. Stack trace: [47773.882335] BUG: KASAN: use-after-free in down_read+0x99/0x460 [47773.883634] Write of size 8 at addr ffff888103b45aa8 by task kworker/u20:6/543704 [47773.885634] CPU: 3 PID: 543704 Comm: kworker/u20:6 Not tainted 5.12.0-rc7+ #2 [47773.886745] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009) [47773.888438] Workqueue: nf_ft_offload_del flow_offload_work_handler [nf_flow_table] [47773.889727] Call Trace: [47773.890214] dump_stack+0xbb/0x107 [47773.890818] print_address_description.constprop.0+0x18/0x140 [47773.892990] kasan_report.cold+0x7c/0xd8 [47773.894459] kasan_check_range+0x145/0x1a0 [47773.895174] down_read+0x99/0x460 [47773.899706] nf_flow_offload_tuple+0x24f/0x3c0 [nf_flow_table] [47773.907137] flow_offload_work_handler+0x72d/0xbe0 [nf_flow_table] [47773.913372] process_one_work+0x8ac/0x14e0 [47773.921325] [47773.921325] Allocated by task 592159: [47773.922031] kasan_save_stack+0x1b/0x40 [47773.922730] __kasan_kmalloc+0x7a/0x90 [47773.923411] tcf_ct_flow_table_get+0x3cb/0x1230 [act_ct] [47773.924363] tcf_ct_init+0x71c/0x1156 [act_ct] [47773.925207] tcf_action_init_1+0x45b/0x700 [47773.925987] tcf_action_init+0x453/0x6b0 [47773.926692] tcf_exts_validate+0x3d0/0x600 [47773.927419] fl_change+0x757/0x4a51 [cls_flower] [47773.928227] tc_new_tfilter+0x89a/0x2070 [47773.936652] [47773.936652] Freed by task 543704: [47773.937303] kasan_save_stack+0x1b/0x40 [47773.938039] kasan_set_track+0x1c/0x30 [47773.938731] kasan_set_free_info+0x20/0x30 [47773.939467] __kasan_slab_free+0xe7/0x120 [47773.940194] slab_free_freelist_hook+0x86/0x190 [47773.941038] kfree+0xce/0x3a0 [47773.941644] tcf_ct_flow_table_cleanup_work Original patch description and stack trace by Paul Blakey.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: c29f74e0df7a02b8303bcdce93a7c0132d62577a , < 8fbdec08dbf7d7ab8e35bdc65eb4394bc82d1e26 (git)
Affected: c29f74e0df7a02b8303bcdce93a7c0132d62577a , < 89e135a36a9eb81412b5459df94a80995ce62eef (git)
Affected: c29f74e0df7a02b8303bcdce93a7c0132d62577a , < 9afb4b27349a499483ae0134282cefd0c90f480f (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.5
Unaffected: 0 , < 5.5 (semver)
Unaffected: 5.15.64 , ≤ 5.15.* (semver)
Unaffected: 5.19.6 , ≤ 5.19.* (semver)
Unaffected: 6.0 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/net/netfilter/nf_flow_table.h",
            "net/netfilter/nf_flow_table_core.c",
            "net/netfilter/nf_flow_table_offload.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "8fbdec08dbf7d7ab8e35bdc65eb4394bc82d1e26",
              "status": "affected",
              "version": "c29f74e0df7a02b8303bcdce93a7c0132d62577a",
              "versionType": "git"
            },
            {
              "lessThan": "89e135a36a9eb81412b5459df94a80995ce62eef",
              "status": "affected",
              "version": "c29f74e0df7a02b8303bcdce93a7c0132d62577a",
              "versionType": "git"
            },
            {
              "lessThan": "9afb4b27349a499483ae0134282cefd0c90f480f",
              "status": "affected",
              "version": "c29f74e0df7a02b8303bcdce93a7c0132d62577a",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/net/netfilter/nf_flow_table.h",
            "net/netfilter/nf_flow_table_core.c",
            "net/netfilter/nf_flow_table_offload.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.5"
            },
            {
              "lessThan": "5.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.64",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.19.*",
              "status": "unaffected",
              "version": "5.19.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.64",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.19.6",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: flowtable: fix stuck flows on cleanup due to pending work\n\nTo clear the flow table on flow table free, the following sequence\nnormally happens in order:\n\n  1) gc_step work is stopped to disable any further stats/del requests.\n  2) All flow table entries are set to teardown state.\n  3) Run gc_step which will queue HW del work for each flow table entry.\n  4) Waiting for the above del work to finish (flush).\n  5) Run gc_step again, deleting all entries from the flow table.\n  6) Flow table is freed.\n\nBut if a flow table entry already has pending HW stats or HW add work\nstep 3 will not queue HW del work (it will be skipped), step 4 will wait\nfor the pending add/stats to finish, and step 5 will queue HW del work\nwhich might execute after freeing of the flow table.\n\nTo fix the above, this patch flushes the pending work, then it sets the\nteardown flag to all flows in the flowtable and it forces a garbage\ncollector run to queue work to remove the flows from hardware, then it\nflushes this new pending work and (finally) it forces another garbage\ncollector run to remove the entry from the software flowtable.\n\nStack trace:\n[47773.882335] BUG: KASAN: use-after-free in down_read+0x99/0x460\n[47773.883634] Write of size 8 at addr ffff888103b45aa8 by task kworker/u20:6/543704\n[47773.885634] CPU: 3 PID: 543704 Comm: kworker/u20:6 Not tainted 5.12.0-rc7+ #2\n[47773.886745] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009)\n[47773.888438] Workqueue: nf_ft_offload_del flow_offload_work_handler [nf_flow_table]\n[47773.889727] Call Trace:\n[47773.890214]  dump_stack+0xbb/0x107\n[47773.890818]  print_address_description.constprop.0+0x18/0x140\n[47773.892990]  kasan_report.cold+0x7c/0xd8\n[47773.894459]  kasan_check_range+0x145/0x1a0\n[47773.895174]  down_read+0x99/0x460\n[47773.899706]  nf_flow_offload_tuple+0x24f/0x3c0 [nf_flow_table]\n[47773.907137]  flow_offload_work_handler+0x72d/0xbe0 [nf_flow_table]\n[47773.913372]  process_one_work+0x8ac/0x14e0\n[47773.921325]\n[47773.921325] Allocated by task 592159:\n[47773.922031]  kasan_save_stack+0x1b/0x40\n[47773.922730]  __kasan_kmalloc+0x7a/0x90\n[47773.923411]  tcf_ct_flow_table_get+0x3cb/0x1230 [act_ct]\n[47773.924363]  tcf_ct_init+0x71c/0x1156 [act_ct]\n[47773.925207]  tcf_action_init_1+0x45b/0x700\n[47773.925987]  tcf_action_init+0x453/0x6b0\n[47773.926692]  tcf_exts_validate+0x3d0/0x600\n[47773.927419]  fl_change+0x757/0x4a51 [cls_flower]\n[47773.928227]  tc_new_tfilter+0x89a/0x2070\n[47773.936652]\n[47773.936652] Freed by task 543704:\n[47773.937303]  kasan_save_stack+0x1b/0x40\n[47773.938039]  kasan_set_track+0x1c/0x30\n[47773.938731]  kasan_set_free_info+0x20/0x30\n[47773.939467]  __kasan_slab_free+0xe7/0x120\n[47773.940194]  slab_free_freelist_hook+0x86/0x190\n[47773.941038]  kfree+0xce/0x3a0\n[47773.941644]  tcf_ct_flow_table_cleanup_work\n\nOriginal patch description and stack trace by Paul Blakey."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is triggered by freeing a netfilter/TC flowtable (tc flower + act_ct or nftables flowtable teardown) via netlink configuration, not by processing remote packets. Reachability is local syscall/netlink only.\nAC:L - An attacker who creates HW-offload-flagged flows (act_ct always sets NF_FLOWTABLE_HW_OFFLOAD) and then deletes the filter/flowtable can arrange pending add/stats work so the broken free sequence queues del work after the table is freed. Both sides of the lifecycle are attacker-controlled and reliably repeatable.\nPR:L - Creating and deleting these objects requires CAP_NET_ADMIN checked in the network namespace\u0027s user_ns (rtnetlink/nfnetlink). That capability is obtainable by an unprivileged user via user namespaces (unshare -Urn), so privileges are Low, not High.\nUI:N - The attacker issues the netlink configuration and traffic themselves; no separate victim action is required.\nS:U - This is a same-host kernel UAF leading to privilege escalation within the kernel\u0027s security authority, not a VM/IOMMU/sandbox boundary cross.\nC:H - KASAN confirms a use-after-free on the freed flowtable object (down_read on flow_block_lock after tcf_ct_flow_table_cleanup_work/kfree). UAF of a reclaimable slab object enables arbitrary read primitives.\nI:H - The same UAF write into the freed object (and dangling work holding flowtable/flow pointers) is exploitable for heap corruption and control-flow hijacking via reclaim/spray.\nA:H - The UAF causes kernel oops/panic (demonstrated KASAN write-after-free in the offload del workqueue), which is a complete availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:57:08.735Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/8fbdec08dbf7d7ab8e35bdc65eb4394bc82d1e26"
        },
        {
          "url": "https://git.kernel.org/stable/c/89e135a36a9eb81412b5459df94a80995ce62eef"
        },
        {
          "url": "https://git.kernel.org/stable/c/9afb4b27349a499483ae0134282cefd0c90f480f"
        }
      ],
      "title": "netfilter: flowtable: fix stuck flows on cleanup due to pending work",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-50000",
    "datePublished": "2025-06-18T11:00:59.959Z",
    "dateReserved": "2025-06-18T10:57:27.387Z",
    "dateUpdated": "2026-08-05T08:57:08.735Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-50000",
      "date": "2026-09-18",
      "epss": "0.00226",
      "percentile": "0.1363"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "include/net/netfilter/nf_flow_table.h",
                  "net/netfilter/nf_flow_table_core.c",
                  "net/netfilter/nf_flow_table_offload.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "8fbdec08dbf7d7ab8e35bdc65eb4394bc82d1e26",
                    "status": "affected",
                    "version": "c29f74e0df7a02b8303bcdce93a7c0132d62577a",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "89e135a36a9eb81412b5459df94a80995ce62eef",
                    "status": "affected",
                    "version": "c29f74e0df7a02b8303bcdce93a7c0132d62577a",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "9afb4b27349a499483ae0134282cefd0c90f480f",
                    "status": "affected",
                    "version": "c29f74e0df7a02b8303bcdce93a7c0132d62577a",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "include/net/netfilter/nf_flow_table.h",
                  "net/netfilter/nf_flow_table_core.c",
                  "net/netfilter/nf_flow_table_offload.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.5"
                  },
                  {
                    "lessThan": "5.5",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.64",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.19.*",
                    "status": "unaffected",
                    "version": "5.19.6",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.0",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "FC3012FD-9A29-406A-8EE7-3E6C8E3D3E7E",
                    "versionEndExcluding": "5.15.64",
                    "versionStartIncluding": "5.5",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "89E99903-E16D-475D-954B-2BAC46C98262",
                    "versionEndExcluding": "5.19.6",
                    "versionStartIncluding": "5.16",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.0:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "E8BD11A3-8643-49B6-BADE-5029A0117325",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.0:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "5F0AD220-F6A9-4012-8636-155F1B841FAD",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: flowtable: fix stuck flows on cleanup due to pending work\n\nTo clear the flow table on flow table free, the following sequence\nnormally happens in order:\n\n  1) gc_step work is stopped to disable any further stats/del requests.\n  2) All flow table entries are set to teardown state.\n  3) Run gc_step which will queue HW del work for each flow table entry.\n  4) Waiting for the above del work to finish (flush).\n  5) Run gc_step again, deleting all entries from the flow table.\n  6) Flow table is freed.\n\nBut if a flow table entry already has pending HW stats or HW add work\nstep 3 will not queue HW del work (it will be skipped), step 4 will wait\nfor the pending add/stats to finish, and step 5 will queue HW del work\nwhich might execute after freeing of the flow table.\n\nTo fix the above, this patch flushes the pending work, then it sets the\nteardown flag to all flows in the flowtable and it forces a garbage\ncollector run to queue work to remove the flows from hardware, then it\nflushes this new pending work and (finally) it forces another garbage\ncollector run to remove the entry from the software flowtable.\n\nStack trace:\n[47773.882335] BUG: KASAN: use-after-free in down_read+0x99/0x460\n[47773.883634] Write of size 8 at addr ffff888103b45aa8 by task kworker/u20:6/543704\n[47773.885634] CPU: 3 PID: 543704 Comm: kworker/u20:6 Not tainted 5.12.0-rc7+ #2\n[47773.886745] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009)\n[47773.888438] Workqueue: nf_ft_offload_del flow_offload_work_handler [nf_flow_table]\n[47773.889727] Call Trace:\n[47773.890214]  dump_stack+0xbb/0x107\n[47773.890818]  print_address_description.constprop.0+0x18/0x140\n[47773.892990]  kasan_report.cold+0x7c/0xd8\n[47773.894459]  kasan_check_range+0x145/0x1a0\n[47773.895174]  down_read+0x99/0x460\n[47773.899706]  nf_flow_offload_tuple+0x24f/0x3c0 [nf_flow_table]\n[47773.907137]  flow_offload_work_handler+0x72d/0xbe0 [nf_flow_table]\n[47773.913372]  process_one_work+0x8ac/0x14e0\n[47773.921325]\n[47773.921325] Allocated by task 592159:\n[47773.922031]  kasan_save_stack+0x1b/0x40\n[47773.922730]  __kasan_kmalloc+0x7a/0x90\n[47773.923411]  tcf_ct_flow_table_get+0x3cb/0x1230 [act_ct]\n[47773.924363]  tcf_ct_init+0x71c/0x1156 [act_ct]\n[47773.925207]  tcf_action_init_1+0x45b/0x700\n[47773.925987]  tcf_action_init+0x453/0x6b0\n[47773.926692]  tcf_exts_validate+0x3d0/0x600\n[47773.927419]  fl_change+0x757/0x4a51 [cls_flower]\n[47773.928227]  tc_new_tfilter+0x89a/0x2070\n[47773.936652]\n[47773.936652] Freed by task 543704:\n[47773.937303]  kasan_save_stack+0x1b/0x40\n[47773.938039]  kasan_set_track+0x1c/0x30\n[47773.938731]  kasan_set_free_info+0x20/0x30\n[47773.939467]  __kasan_slab_free+0xe7/0x120\n[47773.940194]  slab_free_freelist_hook+0x86/0x190\n[47773.941038]  kfree+0xce/0x3a0\n[47773.941644]  tcf_ct_flow_table_cleanup_work\n\nOriginal patch description and stack trace by Paul Blakey."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: netfilter: flowtable: arreglo de flujos atascados en la limpieza debido a trabajo pendiente Para limpiar la tabla de flujo cuando est\u00e1 libre, normalmente ocurre la siguiente secuencia en orden: 1) Se detiene el trabajo de gc_step para deshabilitar cualquier solicitud de estad\u00edsticas/del. 2) Todas las entradas de la tabla de flujo se establecen en estado de desmontaje. 3) Se ejecuta gc_step, que pondr\u00e1 en cola el trabajo de del de HW para cada entrada de la tabla de flujo. 4) Se espera a que finalice el trabajo del del anterior (vaciado). 5) Se vuelve a ejecutar gc_step, eliminando todas las entradas de la tabla de flujo. 6) Se libera la tabla de flujo. Pero si una entrada de la tabla de flujo ya tiene estad\u00edsticas de HW pendientes o trabajo de adici\u00f3n de HW, el paso 3 no pondr\u00e1 en cola el trabajo de del de HW (se omitir\u00e1), el paso 4 esperar\u00e1 a que finalicen las adiciones/estad\u00edsticas pendientes y el paso 5 pondr\u00e1 en cola el trabajo de del de HW que podr\u00eda ejecutarse despu\u00e9s de liberar la tabla de flujo. Para solucionar lo anterior, este parche limpia el trabajo pendiente, luego establece el indicador de desmontaje en todos los flujos en la tabla de flujo y fuerza la ejecuci\u00f3n de un recolector de basura para poner en cola el trabajo para eliminar los flujos del hardware, luego limpia este nuevo trabajo pendiente y (finalmente) fuerza la ejecuci\u00f3n de otro recolector de basura para eliminar la entrada de la tabla de flujo del software. Rastreo de pila: [47773.882335] ERROR: KASAN: Use-After-Free en down_read+0x99/0x460 [47773.883634] Escritura de tama\u00f1o 8 en la direcci\u00f3n ffff888103b45aa8 por la tarea kworker/u20:6/543704 [47773.885634] CPU: 3 PID: 543704 Comm: kworker/u20:6 No contaminado 5.12.0-rc7+ #2 [47773.886745] Nombre del hardware: QEMU Standard PC (Q35 + ICH9, 2009) [47773.888438] Cola de trabajo: nf_ft_offload_del flow_offload_work_handler [nf_flow_table] [47773.889727] Rastreo de llamadas: [47773.890214] dump_stack+0xbb/0x107 [47773.890818] print_address_description.constprop.0+0x18/0x140 [47773.892990] kasan_report.cold+0x7c/0xd8 [47773.894459] kasan_check_range+0x145/0x1a0 [47773.895174] down_read+0x99/0x460 [47773.899706] nf_flow_offload_tuple+0x24f/0x3c0 [nf_flow_table] [47773.907137] flow_offload_work_handler+0x72d/0xbe0 [nf_flow_table] [47773.913372] process_one_work+0x8ac/0x14e0 [47773.921325] [47773.921325] Allocated by task 592159: [47773.922031] kasan_save_stack+0x1b/0x40 [47773.922730] __kasan_kmalloc+0x7a/0x90 [47773.923411] tcf_ct_flow_table_get+0x3cb/0x1230 [act_ct] [47773.924363] tcf_ct_init+0x71c/0x1156 [act_ct] [47773.925207] tcf_action_init_1+0x45b/0x700 [47773.925987] tcf_action_init+0x453/0x6b0 [47773.926692] tcf_exts_validate+0x3d0/0x600 [47773.927419] fl_change+0x757/0x4a51 [cls_flower] [47773.928227] tc_new_tfilter+0x89a/0x2070 [47773.936652] [47773.936652] Freed by task 543704: [47773.937303] kasan_save_stack+0x1b/0x40 [47773.938039] kasan_set_track+0x1c/0x30 [47773.938731] kasan_set_free_info+0x20/0x30 [47773.939467] __kasan_slab_free+0xe7/0x120 [47773.940194] slab_free_freelist_hook+0x86/0x190 [47773.941038] kfree+0xce/0x3a0 [47773.941644] tcf_ct_flow_table_cleanup_work Descripci\u00f3n del parche original y seguimiento de la pila por Paul Blakey."
          }
        ],
        "id": "CVE-2022-50000",
        "lastModified": "2026-08-04T10:18:02.973",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2025-06-18T11:15:27.817",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/89e135a36a9eb81412b5459df94a80995ce62eef"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/8fbdec08dbf7d7ab8e35bdc65eb4394bc82d1e26"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/9afb4b27349a499483ae0134282cefd0c90f480f"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-416"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T19:42:39+00:00",
      "cve": "CVE-2022-50000",
      "id": "CVE-2022-50000",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:fixed": "620",
      "product_status:known_affected": "16",
      "product_status:known_not_affected": "142",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: netfilter: flowtable: fix stuck flows on cleanup due to pending work",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-50000.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.