--- id: CVE-2022-32250 title: >- net/netfilter/nf_tables_api.c in the Linux kernel through 5.18.1 allows a local user (able to create user/net namespaces) to escalate privileges to root because an incorrect NFT_STATEFUL_EXPR check leads to a use-after-free. summary: >- net/netfilter/nf_tables_api.c in the Linux kernel through 5.18.1 allows a local user (able to create user/net namespaces) to escalate privileges to root because an incorrect NFT_STATEFUL_EXPR check leads to a use-after-free. severity: high cvss: 7.8 cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H' cwe: - CWE-416 vendor: linux product: linux_kernel affected: - 'linux_kernel >= 4.1, < 4.9.318' - 'linux_kernel >= 4.10, < 4.14.283' - 'linux_kernel >= 4.15, < 4.19.247' - 'linux_kernel >= 4.20, < 5.4.198' - 'linux_kernel >= 5.5, < 5.10.120' - 'linux_kernel >= 5.11, < 5.15.45' - 'linux_kernel >= 5.16, < 5.17.13' - 'linux_kernel >= 5.18, < 5.18.2' - fedora = 35 - fedora = 36 - debian_linux = 9.0 - debian_linux = 10.0 - h300s_firmware - h500s_firmware - h700s_firmware - h410s_firmware - h410c_firmware patched: - linux_kernel 5.18.2 published: '2022-06-02' updated: '2026-10-14' sourceUpdated: '2026-10-14T17:17:40.140' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2022-32250' references: - url: 'http://www.openwall.com/lists/oss-security/2022/06/03/1' label: cve@mitre.org - url: 'http://www.openwall.com/lists/oss-security/2022/06/04/1' label: cve@mitre.org - url: 'http://www.openwall.com/lists/oss-security/2022/06/20/1' label: cve@mitre.org - url: 'http://www.openwall.com/lists/oss-security/2022/07/03/5' label: cve@mitre.org - url: 'http://www.openwall.com/lists/oss-security/2022/07/03/6' label: cve@mitre.org - url: 'http://www.openwall.com/lists/oss-security/2022/08/25/1' label: cve@mitre.org - url: 'http://www.openwall.com/lists/oss-security/2022/09/02/9' label: cve@mitre.org - url: 'https://blog.theori.io/research/CVE-2022-32250-linux-kernel-lpe-2022/' label: cve@mitre.org - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2092427' label: cve@mitre.org - url: >- https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/net/netfilter?id=520778042ccca019f3ffa136dd0ca565c486cedd label: cve@mitre.org - url: 'https://github.com/theori-io/CVE-2022-32250-exploit' label: cve@mitre.org - url: 'https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html' label: cve@mitre.org - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MO6Y3TC4WUUNKRP7OQA26OVTZTPCS6F2/ label: cve@mitre.org - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UIZTJOJCVVEJVOQSCHE6IJQKMPISHQ5L/ label: cve@mitre.org - url: 'https://security.netapp.com/advisory/ntap-20220715-0005/' label: cve@mitre.org - url: 'https://www.debian.org/security/2022/dsa-5161' label: cve@mitre.org - url: 'https://www.debian.org/security/2022/dsa-5173' label: cve@mitre.org - url: 'https://www.openwall.com/lists/oss-security/2022/05/31/1' label: cve@mitre.org - url: 'http://www.openwall.com/lists/oss-security/2022/06/03/1' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'http://www.openwall.com/lists/oss-security/2022/06/04/1' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'http://www.openwall.com/lists/oss-security/2022/06/20/1' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'http://www.openwall.com/lists/oss-security/2022/07/03/5' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'http://www.openwall.com/lists/oss-security/2022/07/03/6' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'http://www.openwall.com/lists/oss-security/2022/08/25/1' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'http://www.openwall.com/lists/oss-security/2022/09/02/9' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://blog.theori.io/research/CVE-2022-32250-linux-kernel-lpe-2022/' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2092427' label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/net/netfilter?id=520778042ccca019f3ffa136dd0ca565c486cedd label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://github.com/theori-io/CVE-2022-32250-exploit' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MO6Y3TC4WUUNKRP7OQA26OVTZTPCS6F2/ label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UIZTJOJCVVEJVOQSCHE6IJQKMPISHQ5L/ label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://security.netapp.com/advisory/ntap-20220715-0005/' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.debian.org/security/2022/dsa-5161' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.debian.org/security/2022/dsa-5173' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.openwall.com/lists/oss-security/2022/05/31/1' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://cert-portal.siemens.com/productcert/html/ssa-794697.html' label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e tags: - nvd - exploit-available - cve.org epss: 0.02914 epssPercentile: 0.86908 exploits: github: 8 githubRepos: - 'https://github.com/theori-io/CVE-2022-32250-exploit' - 'https://github.com/ysanatomic/CVE-2022-32250-LPE' - 'https://github.com/Decstor5/2022-32250LPE' checkedAt: '2026-10-23T21:41:44.047Z' exploitAvailable: true ingestedAt: '2026-10-14T17:44:53.598Z' --- ## Overview net/netfilter/nf_tables_api.c in the Linux kernel through 5.18.1 allows a local user (able to create user/net namespaces) to escalate privileges to root because an incorrect NFT_STATEFUL_EXPR check leads to a use-after-free. ## Affected - `linux_kernel >= 4.1, < 4.9.318` - `linux_kernel >= 4.10, < 4.14.283` - `linux_kernel >= 4.15, < 4.19.247` - `linux_kernel >= 4.20, < 5.4.198` - `linux_kernel >= 5.5, < 5.10.120` - `linux_kernel >= 5.11, < 5.15.45` - `linux_kernel >= 5.16, < 5.17.13` - `linux_kernel >= 5.18, < 5.18.2` - `fedora = 35` - `fedora = 36` - `debian_linux = 9.0` - `debian_linux = 10.0` - `h300s_firmware` - `h500s_firmware` - `h700s_firmware` - `h410s_firmware` - `h410c_firmware` ## Remediation Upgrade past the affected range: - `linux_kernel 5.18.2`