CVE-2022-49558: netfilter: nf_tables: double hook unregistration in netns path

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-02-26 · updated 2026-06-17

Description

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: double hook unregistration in netns path __nft_release_hooks() is called from pre_netns exit path which unregisters the hooks, then the NETDEV_UNREGISTER event is triggered which unregisters the hooks again. [ 565.221461] WARNING: CPU: 18 PID: 193 at net/netfilter/core.c:495 __nf_unregister_net_hook+0x247/0x270 [...] [ 565.246890] CPU: 18 PID: 193 Comm: kworker/u64:1 Tainted: G E 5.18.0-rc7+ #27 [ 565.253682] Workqueue: netns cleanup_net [ 565.257059] RIP: 0010:__nf_unregister_net_hook+0x247/0x270 [...] [ 565.297120] Call Trace: [ 565.300900] <TASK> [ 565.304683] nf_tables_flowtable_event+0x16a/0x220 [nf_tables] [ 565.308518] raw_notifier_call_chain+0x63/0x80 [ 565.312386] unregister_netdevice_many+0x54f/0xb50 Unregister and destroy netdev hook from netns pre_exit via kfree_rcu so the NETDEV_UNREGISTER path see unregistered hooks.

Affected products

Linux kernel: from 5.4.99 before 5.4.262; from 5.10.17 before 5.10.198; from 5.11.1 before 5.15.45; from 5.16 before 5.17.13; from 5.18 before 5.18.2; 5.11 — fixed in 5.10.198, 5.15.45, 5.17.13, 5.18.2, 5.4.262

How to fix

Upgrade to a fixed version: Linux kernel 5.10.198, 5.15.45, 5.17.13, 5.18.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-49558 or the next vulnerability affects your stack