CVE-2022-49358

netfilter: nf_tables: memleak flow rule from commit path

State: Published
Severity: 5.5 Medium
Published: Feb 26, 2025
Updated: May 11, 2026
Reserved: Feb 26, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_tables: memleak flow rule from commit path

Abort path release flow rule object, however, commit path does not. Update code to destroy these objects before releasing the transaction.

Scores

CVSS	Score	Vector	Source
3.1	5.5 Medium	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H	CISA-ADP

Weaknesses

CWE-401 Missing Release of Memory after Effective Lifetime

Affected Products

Product	Versions
LinuxLinux	c9626a2cbdb20e26587b3fad99960520a023432b to before 5b8d63489c3b701eb2a76f848ec94d8cbc9373b9Affected c9626a2cbdb20e26587b3fad99960520a023432b to before 330c0c6cd2150a2d7f47af16aa590078b0d2f736Affected c9626a2cbdb20e26587b3fad99960520a023432b to before e33d9bd563e71f6c6528b96008d65524a459c4dcAffected c9626a2cbdb20e26587b3fad99960520a023432b to before 80de9ea1f5b808a6601e91111fae601df2b26369Affected c9626a2cbdb20e26587b3fad99960520a023432b to before ab9f34a30c23f656e76f4c5b83125a4e7b53c86eAffected c9626a2cbdb20e26587b3fad99960520a023432b to before 9dd732e0bdf538b1b76dc7c157e2b5e560ff30d3Affected
LinuxLinux	5.3Affected before 5.3Not affected 5.4.198 through 5.4.Not affected 5.10.122 through 5.10.Not affected 5.15.47 through 5.15.Not affected 5.17.15 through 5.17.Not affected 5.18.4 through 5.18.*Not affected 5.19 and laterNot affected

Product

Versions

LinuxLinux

c9626a2cbdb20e26587b3fad99960520a023432b to before 5b8d63489c3b701eb2a76f848ec94d8cbc9373b9Affected
c9626a2cbdb20e26587b3fad99960520a023432b to before 330c0c6cd2150a2d7f47af16aa590078b0d2f736Affected
c9626a2cbdb20e26587b3fad99960520a023432b to before e33d9bd563e71f6c6528b96008d65524a459c4dcAffected
c9626a2cbdb20e26587b3fad99960520a023432b to before 80de9ea1f5b808a6601e91111fae601df2b26369Affected
c9626a2cbdb20e26587b3fad99960520a023432b to before ab9f34a30c23f656e76f4c5b83125a4e7b53c86eAffected
c9626a2cbdb20e26587b3fad99960520a023432b to before 9dd732e0bdf538b1b76dc7c157e2b5e560ff30d3Affected

LinuxLinux

5.3Affected
before 5.3Not affected
5.4.198 through 5.4.*Not affected
5.10.122 through 5.10.*Not affected
5.15.47 through 5.15.*Not affected
5.17.15 through 5.17.*Not affected
5.18.4 through 5.18.*Not affected
5.19 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.