CVE-2022-48911

netfilter: nf_queue: fix possible use-after-free

State: Published
Severity: 7.8 High
Published: Aug 22, 2024
Updated: Aug 5, 2026
Reserved: Aug 21, 2024

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_queue: fix possible use-after-free

Eric Dumazet says: The sock_hold() side seems suspect, because there is no guarantee that sk_refcnt is not already 0.

On failure, we cannot queue the packet and need to indicate an error. The packet will be dropped by the caller.

v2: split skb prefetch hunk into separate change

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	271b72c7fa82c2c7a795bc16896149933110672d to before 21b27b2baa27423286e9b8d3f0b194d587083d95Affected 271b72c7fa82c2c7a795bc16896149933110672d to before ef97921ccdc243170fcef857ba2a17cf697aece5Affected 271b72c7fa82c2c7a795bc16896149933110672d to before 34dc4a6a7f261736ef7183868a5bddad31c7f9e3Affected 271b72c7fa82c2c7a795bc16896149933110672d to before 43c25da41e3091b31a906651a43e80a2719aa1ffAffected 271b72c7fa82c2c7a795bc16896149933110672d to before 4d05239203fa38ea8a6f31e228460da4cb17a71aAffected 271b72c7fa82c2c7a795bc16896149933110672d to before dd648bd1b33a828f62befa696b206c688da0ec43Affected 271b72c7fa82c2c7a795bc16896149933110672d to before dcc3cb920bf7ba66ac5e9272293a9ba5f80917eeAffected 271b72c7fa82c2c7a795bc16896149933110672d to before c3873070247d9e3c7a6b0cf9bf9b45e8018427b1Affected
LinuxLinux	2.6.29Affected before 2.6.29Not affected 4.9.305 through 4.9.Not affected 4.14.270 through 4.14.Not affected 4.19.233 through 4.19.Not affected 5.4.183 through 5.4.Not affected 5.10.104 through 5.10.Not affected 5.15.27 through 5.15.Not affected 5.16.13 through 5.16.*Not affected 5.17 and laterNot affected

Product

Versions

LinuxLinux

271b72c7fa82c2c7a795bc16896149933110672d to before 21b27b2baa27423286e9b8d3f0b194d587083d95Affected
271b72c7fa82c2c7a795bc16896149933110672d to before ef97921ccdc243170fcef857ba2a17cf697aece5Affected
271b72c7fa82c2c7a795bc16896149933110672d to before 34dc4a6a7f261736ef7183868a5bddad31c7f9e3Affected
271b72c7fa82c2c7a795bc16896149933110672d to before 43c25da41e3091b31a906651a43e80a2719aa1ffAffected
271b72c7fa82c2c7a795bc16896149933110672d to before 4d05239203fa38ea8a6f31e228460da4cb17a71aAffected
271b72c7fa82c2c7a795bc16896149933110672d to before dd648bd1b33a828f62befa696b206c688da0ec43Affected
271b72c7fa82c2c7a795bc16896149933110672d to before dcc3cb920bf7ba66ac5e9272293a9ba5f80917eeAffected
271b72c7fa82c2c7a795bc16896149933110672d to before c3873070247d9e3c7a6b0cf9bf9b45e8018427b1Affected

LinuxLinux

2.6.29Affected
before 2.6.29Not affected
4.9.305 through 4.9.*Not affected
4.14.270 through 4.14.*Not affected
4.19.233 through 4.19.*Not affected
5.4.183 through 5.4.*Not affected
5.10.104 through 5.10.*Not affected
5.15.27 through 5.15.*Not affected
5.16.13 through 5.16.*Not affected
5.17 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.