CVE-2022-49558

netfilter: nf_tables: double hook unregistration in netns path

MEDIUM

5.5

CVSS Score

Published: February 26, 2025 at 02:14 AM UTC

Updated: June 17, 2026 at 05:18 AM UTC

1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM5.5

Exploit prediction

EPSS 0.3%

Description

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: double hook unregistration in netns path __nft_release_hooks() is called from pre_netns exit path which unregisters the hooks, then the NETDEV_UNREGISTER event is triggered which unregisters the hooks again. [ 565.221461] WARNING: CPU: 18 PID: 193 at net/netfilter/core.c:495 __nf_unregister_net_hook+0x247/0x270 [...] [ 565.246890] CPU: 18 PID: 193 Comm: kworker/u64:1 Tainted: G E 5.18.0-rc7+ #27 [ 565.253682] Workqueue: netns cleanup_net [ 565.257059] RIP: 0010:__nf_unregister_net_hook+0x247/0x270 [...] [ 565.297120] Call Trace: [ 565.300900] <TASK> [ 565.304683] nf_tables_flowtable_event+0x16a/0x220 [nf_tables] [ 565.308518] raw_notifier_call_chain+0x63/0x80 [ 565.312386] unregister_netdevice_many+0x54f/0xb50 Unregister and destroy netdev hook from netns pre_exit via kfree_rcu so the NETDEV_UNREGISTER path see unregistered hooks.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Linux Kernel · Linux

95%

5.10.17 ≤ v < 5.10.1985.11 ≤ v < 5.15.455.11 ≤ v < 5.17.135.11 ≤ v < 5.18.25.11 ≤ v < 5.195.11.1 ≤ v < 5.15.455.16 ≤ v < 5.17.135.18 ≤ v < 5.18.25.4.99 ≤ v < 5.4.2620a0e5d47670b753d3dbf88f3c77a97a30864d9bd5.10.17 5.11 5.4.99767d1216bff82507c945e92fe719dff2083bb2f4b110391d1e806167254d3c7ae5d637191d913175

Vendor states this is fixed in 3fac8ce48fa9fd61ee9056d3ed48b2edefca8b82 (fixed)

Vendor states this is fixed in 86c0154f4c3a56c5db8b9dd09e3ce885382c2c19 (fixed)

Vendor states this is fixed in 9c413a8c8bb49cc16796371805ecb260e885bb2b (fixed)

Vendor states this is fixed in a3940dcf552f2393d1e8f263b386593f98abe829 (fixed)

Vendor states this is fixed in b09e6ccf0d12f9356e8e3508d3e3dce126298538 (fixed)

Vendor states this is fixed in f9a43007d3f7ba76d5e7f9421094f00f2ef202f8 (fixed)

Vendor states this is fixed in 5.10.198 (unaffected)

Vendor states this is fixed in 5.11 (unaffected)

Vendor states this is fixed in 5.15.45 (unaffected)

Vendor states this is fixed in 5.17.13 (unaffected)

Vendor states this is fixed in 5.18.2 (unaffected)

Vendor states this is fixed in 5.19 (unaffected)