CVE-2022-1055

Use after Free in tc_new_tfilter allowing for privilege escalation in Linux Kernel

HIGH

7.8

CVSS Score

Published: March 29, 2022 at 03:05 PM UTC

Updated: August 13, 2026 at 07:47 PM UTC

20 products affected across 5 vendorsLinux KernelFedoraUbuntu Linux

Using Kernel by Linux?

Get instant alerts when new vulnerabilities affect Kernel - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH7.8

Exploit prediction

EPSS 0.5%

SSVC

PoC

Description

A use-after-free exists in the Linux Kernel in tc_new_tfilter that could allow a local attacker to gain privilege escalation. The exploit requires unprivileged user namespaces. We recommend upgrading past commit 04c2a47ffb13c29778e2a14e414ad4cb5a5db4b5

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Ubuntu Linux · Canonicalrubygems

95%

16.04 18.04 20.04 21.10 22.04

Fedora · Fedora Projectrpm

95%

Linux Kernel · Linux

95%

v < 5.17_rc35.1 ≤ v < 5.4.1775.1.0 ≤ v < 5.4.1775.11 ≤ v < 5.15.205.11.0 ≤ v < 5.15.205.16 ≤ v < 5.16.65.16.0 ≤ v < 5.16.65.5 ≤ v < 5.10.975.5.0 ≤ v < 5.10.975.1.0 5.11.0 5.16.0 5.5.0

Vendor states this is fixed in 4c2a47ffb13c29778e2a14e414ad4cb5a5db4b5 (unaffected)

Affected range stops below 5.10.97, so it looks safe — our inference, not a vendor statement

Affected range stops below 5.15.20, so it looks safe — our inference, not a vendor statement

Affected range stops below 5.16.6, so it looks safe — our inference, not a vendor statement

Vendor states this is fixed in 5.17.0 (unaffected)

Affected range stops below 5.17_rc3, so it looks safe — our inference, not a vendor statement

Affected range stops below 5.4.177, so it looks safe — our inference, not a vendor statement

H300E Firmware · NetAppdrupal

95%

All versions

netapp-h300e (same device)

H300S Firmware · NetAppdrupal