CVE-2022-4696

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2023-01-11 · updated 2026-09-01
Weakness: CWE-763

Description

There exists a use-after-free vulnerability in the Linux kernel through io_uring and the IORING_OP_SPLICE operation. If IORING_OP_SPLICE is missing the IO_WQ_WORK_FILES flag, which signals that the operation won't use current->nsproxy, so its reference counter is not increased. This assumption is not always true as calling io_splice on specific files will call the get_uts function which will use current->nsproxy leading to invalidly decreasing its reference counter later causing the use-after-free vulnerability. We recommend upgrading to version 5.10.160 or above

Affected products

Linux kernel: from 5.4 before 5.10.160; from 5.11 before 5.12 — fixed in 5.10.160, 5.12
NetApp H300S Firmware: all versions
NetApp H410C Firmware: all versions
NetApp H410S Firmware: all versions
NetApp H500S Firmware: all versions
NetApp H700S Firmware: all versions

How to fix

Upgrade to a fixed version: Linux kernel 5.10.160, 5.12. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-4696 or the next vulnerability affects your stack