CVE-2022-32250High· 7.8▾ MidnightPoC availablenet/netfilter/nf_tables_api.c in the Linux kernel through 5.18.1 allows a local user (able to create user/net namespaces) to escalate privileges to root because an incorrect NFT_STATEFUL_EXPR check leads to a use-after-free.
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 42.9 · likelihood 0.6 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Exploit-prediction probability, daily snapshots since Oct 14.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
2.9%
8 GitHub repos (last check)
net/netfilter/nf_tables_api.c in the Linux kernel through 5.18.1 allows a local user (able to create user/net namespaces) to escalate privileges to root because an incorrect NFT_STATEFUL_EXPR check leads to a use-after-free.
linux_kernel >= 4.1, < 4.9.318linux_kernel >= 4.10, < 4.14.283linux_kernel >= 4.15, < 4.19.247linux_kernel >= 4.20, < 5.4.198linux_kernel >= 5.5, < 5.10.120linux_kernel >= 5.11, < 5.15.45linux_kernel >= 5.16, < 5.17.13linux_kernel >= 5.18, < 5.18.2fedora = 35fedora = 36debian_linux = 9.0debian_linux = 10.0h300s_firmwareh500s_firmwareh700s_firmwareh410s_firmwareh410c_firmwareUpgrade past the affected range:
linux_kernel 5.18.2Connected by shared product, vendor, weakness, or advisory.
CVE-2023-3610High· 7.8A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. Flaw in the error handling of bound chains causes a use-after-free in the abort path of NFT_MSG_…
CVE-2022-2978High· 7.8A flaw use after free in the Linux kernel NILFS file system was found in the way user triggers function security_inode_alloc to fail with following call to function nilfs_mdt_destroy
CVE-2026-23010High· 7.8In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix use-after-free in inet6_addr_del(). syzbot reported use-after-free of inet6_ifaddr in inet6_addr_del()
CVE-2023-52447High· 7.8In the Linux kernel, the following vulnerability has been resolved: bpf: Defer the free of inner map when necessary When updating or deleting an inner map in map array or map htab, the map may still be accessed by non-sleepable program…
CVE-2026-23111High· 7.8In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() nft_map_catchall_activate() has an inverted element activity check compared to its non-…
CVE-2024-58002High· 7.8In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Remove dangling pointers When an async control is written, we copy a pointer to the file handle that started the operation