CVE-2022-49561

netfilter: conntrack: re-fetch conntrack after insertion

State: Published
Severity: 9.8 Critical
Published: Feb 26, 2025
Updated: Aug 5, 2026
Reserved: Feb 26, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: conntrack: re-fetch conntrack after insertion

In case the conntrack is clashing, insertion can free skb->_nfct and set skb->_nfct to the already-confirmed entry.

This wasn't found before because the conntrack entry and the extension space used to free'd after an rcu grace period, plus the race needs events enabled to trigger.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	71d8c47fc653711c41bc3282e5b0e605b3727956 to before e97222b785e70e8973281666d709baad6523d8afAffected 71d8c47fc653711c41bc3282e5b0e605b3727956 to before 92a999d1963eed0df666284e20055136ceabd12fAffected 71d8c47fc653711c41bc3282e5b0e605b3727956 to before b16bb373988da3ceb0308381634117e18b6ec60dAffected 71d8c47fc653711c41bc3282e5b0e605b3727956 to before 91a36ec160ec1a0c8f5352b772dffcbb0b6023e3Affected 71d8c47fc653711c41bc3282e5b0e605b3727956 to before 01989d7eebb61c99bd4b88ebc8e261bd2f02caedAffected 71d8c47fc653711c41bc3282e5b0e605b3727956 to before 04f9e9104c969d8ce10a4a43634f641ed082092dAffected 71d8c47fc653711c41bc3282e5b0e605b3727956 to before 04e4a11dc723c52db7a36dc58f0d69ce6426f8f0Affected 71d8c47fc653711c41bc3282e5b0e605b3727956 to before 56b14ecec97f39118bf85c9ac2438c5a949509edAffected
LinuxLinux	4.7Affected before 4.7Not affected 4.14.282 through 4.14.Not affected 4.19.246 through 4.19.Not affected 5.4.197 through 5.4.Not affected 5.10.120 through 5.10.Not affected 5.15.45 through 5.15.Not affected 5.17.13 through 5.17.Not affected 5.18.2 through 5.18.*Not affected 5.19 and laterNot affected

Product

Versions

LinuxLinux

71d8c47fc653711c41bc3282e5b0e605b3727956 to before e97222b785e70e8973281666d709baad6523d8afAffected
71d8c47fc653711c41bc3282e5b0e605b3727956 to before 92a999d1963eed0df666284e20055136ceabd12fAffected
71d8c47fc653711c41bc3282e5b0e605b3727956 to before b16bb373988da3ceb0308381634117e18b6ec60dAffected
71d8c47fc653711c41bc3282e5b0e605b3727956 to before 91a36ec160ec1a0c8f5352b772dffcbb0b6023e3Affected
71d8c47fc653711c41bc3282e5b0e605b3727956 to before 01989d7eebb61c99bd4b88ebc8e261bd2f02caedAffected
71d8c47fc653711c41bc3282e5b0e605b3727956 to before 04f9e9104c969d8ce10a4a43634f641ed082092dAffected
71d8c47fc653711c41bc3282e5b0e605b3727956 to before 04e4a11dc723c52db7a36dc58f0d69ce6426f8f0Affected
71d8c47fc653711c41bc3282e5b0e605b3727956 to before 56b14ecec97f39118bf85c9ac2438c5a949509edAffected

LinuxLinux

4.7Affected
before 4.7Not affected
4.14.282 through 4.14.*Not affected
4.19.246 through 4.19.*Not affected
5.4.197 through 5.4.*Not affected
5.10.120 through 5.10.*Not affected
5.15.45 through 5.15.*Not affected
5.17.13 through 5.17.*Not affected
5.18.2 through 5.18.*Not affected
5.19 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.