CVE-2022-49558

netfilter: nf_tables: double hook unregistration in netns path

State: Published
Severity: Not scored
Published: Feb 26, 2025
Updated: May 23, 2026
Reserved: Feb 26, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_tables: double hook unregistration in netns path

__nft_release_hooks() is called from pre_netns exit path which unregisters the hooks, then the NETDEV_UNREGISTER event is triggered which unregisters the hooks again.

[ 565.221461] WARNING: CPU: 18 PID: 193 at net/netfilter/core.c:495 __nf_unregister_net_hook+0x247/0x270 [...] [ 565.246890] CPU: 18 PID: 193 Comm: kworker/u64:1 Tainted: G E 5.18.0-rc7+ #27 [ 565.253682] Workqueue: netns cleanup_net [ 565.257059] RIP: 0010:__nf_unregister_net_hook+0x247/0x270 [...] [ 565.297120] Call Trace: [ 565.300900] <TASK> [ 565.304683] nf_tables_flowtable_event+0x16a/0x220 [nf_tables] [ 565.308518] raw_notifier_call_chain+0x63/0x80 [ 565.312386] unregister_netdevice_many+0x54f/0xb50

Unregister and destroy netdev hook from netns pre_exit via kfree_rcu so the NETDEV_UNREGISTER path see unregistered hooks.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	b110391d1e806167254d3c7ae5d637191d913175 to before b09e6ccf0d12f9356e8e3508d3e3dce126298538Affected 0a0e5d47670b753d3dbf88f3c77a97a30864d9bd to before 3fac8ce48fa9fd61ee9056d3ed48b2edefca8b82Affected 767d1216bff82507c945e92fe719dff2083bb2f4 to before 9c413a8c8bb49cc16796371805ecb260e885bb2bAffected 767d1216bff82507c945e92fe719dff2083bb2f4 to before a3940dcf552f2393d1e8f263b386593f98abe829Affected 767d1216bff82507c945e92fe719dff2083bb2f4 to before 86c0154f4c3a56c5db8b9dd09e3ce885382c2c19Affected 767d1216bff82507c945e92fe719dff2083bb2f4 to before f9a43007d3f7ba76d5e7f9421094f00f2ef202f8Affected 5.4.99 to before 5.4.262Affected 5.10.17 to before 5.10.198Affected
LinuxLinux	5.11Affected before 5.11Not affected 5.4.262 through 5.4.Not affected 5.10.198 through 5.10.Not affected 5.15.45 through 5.15.Not affected 5.17.13 through 5.17.Not affected 5.18.2 through 5.18.*Not affected 5.19 and laterNot affected

Product

Versions

LinuxLinux

b110391d1e806167254d3c7ae5d637191d913175 to before b09e6ccf0d12f9356e8e3508d3e3dce126298538Affected
0a0e5d47670b753d3dbf88f3c77a97a30864d9bd to before 3fac8ce48fa9fd61ee9056d3ed48b2edefca8b82Affected
767d1216bff82507c945e92fe719dff2083bb2f4 to before 9c413a8c8bb49cc16796371805ecb260e885bb2bAffected
767d1216bff82507c945e92fe719dff2083bb2f4 to before a3940dcf552f2393d1e8f263b386593f98abe829Affected
767d1216bff82507c945e92fe719dff2083bb2f4 to before 86c0154f4c3a56c5db8b9dd09e3ce885382c2c19Affected
767d1216bff82507c945e92fe719dff2083bb2f4 to before f9a43007d3f7ba76d5e7f9421094f00f2ef202f8Affected
5.4.99 to before 5.4.262Affected
5.10.17 to before 5.10.198Affected

LinuxLinux

5.11Affected
before 5.11Not affected
5.4.262 through 5.4.*Not affected
5.10.198 through 5.10.*Not affected
5.15.45 through 5.15.*Not affected
5.17.13 through 5.17.*Not affected
5.18.2 through 5.18.*Not affected
5.19 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.