What’s Vulnerable › Vulnerabilities

CVE-2022-1882

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-05-26 · updated 2026-10-14
• Weakness: CWE-416

Description

A use-after-free flaw was found in the Linux kernel’s pipes functionality in how a user performs manipulations with the pipe post_one_notification() after free_pipe_info() that is already called. This flaw allows a local user to crash or potentially escalate their privileges on the system.

Affected products

• Linux kernel: from 5.10.106 before 5.10.134; from 5.15.29 before 5.15.58; from 5.16.15 before 5.18.15 — fixed in 5.10.134, 5.15.58, 5.18.15
• NetApp H300E Firmware: all versions
• NetApp H300S Firmware: all versions
• NetApp H410C Firmware: all versions
• NetApp H410S Firmware: all versions
• NetApp H500E Firmware: all versions
• NetApp H500S Firmware: all versions
• NetApp H700E Firmware: all versions
• NetApp H700S Firmware: all versions

How to fix

Upgrade to a fixed version: Linux kernel 5.10.134, 5.15.58, 5.18.15. Check the vendor advisory for mitigations.

References

• https://bugzilla.redhat.com/show_bug.cgi?id=2089701
• https://lore.kernel.org/lkml/20220507115605.96775-1-tcs.kernel%40gmail.com/T/
• https://security.netapp.com/advisory/ntap-20220715-0002/
• https://bugzilla.redhat.com/show_bug.cgi?id=2089701
• https://lore.kernel.org/lkml/20220507115605.96775-1-tcs.kernel%40gmail.com/T/
• https://security.netapp.com/advisory/ntap-20220715-0002/
• https://cert-portal.siemens.com/productcert/html/ssa-794697.html
• https://cert-portal.siemens.com/productcert/html/ssa-831302.html

Get alerted when CVE-2022-1882 or the next vulnerability affects your stack