Riskcovery

CVE-2022-49110

netfilter: conntrack: revisit gc autotuning

State
Published
Severity
7.5 High
Published
Feb 26, 2025
Updated
Oct 15, 2026
Reserved
Feb 26, 2025

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: conntrack: revisit gc autotuning

as of commit 4608fdfc07e1 ("netfilter: conntrack: collect all entries in one cycle") conntrack gc was changed to run every 2 minutes.

On systems where conntrack hash table is set to large value, most evictions happen from gc worker rather than the packet path due to hash table distribution.

This causes netlink event overflows when events are collected.

This change collects average expiry of scanned entries and reschedules to the average remaining value, within 1 to 60 second interval.

To avoid event overflows, reschedule after each bucket and add a limit for both run time and number of evictions per run.

If more entries have to be evicted, reschedule and restart 1 jiffy into the future.

Scores

CVSSScoreVectorSource
3.17.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 4608fdfc07e116f9fc0895beb40abad7cdb5ee3d to before 58d52743ae85d28c9335c6034d6ce350b8689951Affected
  • 4608fdfc07e116f9fc0895beb40abad7cdb5ee3d to before 7cd361d5e6d986c0d4cafb9ceaa803359048ae15Affected
  • 4608fdfc07e116f9fc0895beb40abad7cdb5ee3d to before 592e57591826f3d09c28d755a39ea8e9d13705adAffected
  • 4608fdfc07e116f9fc0895beb40abad7cdb5ee3d to before 2cfadb761d3d0219412fd8150faea60c7e863833Affected
  • dafc95a1e473a0b857af34ecbb17b8b1c90edd75Affected
  • 5892f910f401c1facfc410e0b042108f2827a77bAffected
  • f68ad168e23565ce2a3891fec537cfaf8410d1e6Affected
  • 7aa03980b21fdc7355e20274a68a69a0b2a45c08Affected
  • 4.19.206 to before 4.20Affected
  • 5.4.144 to before 5.5Affected
  • 5.10.62 to before 5.11Affected
  • 5.13.14 to before 5.14Affected
LinuxLinux
  • 5.14Affected
  • before 5.14Not affected
  • 5.15.34 through 5.15.*Not affected
  • 5.16.20 through 5.16.*Not affected
  • 5.17.3 through 5.17.*Not affected
  • 5.18 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.