CVE-2022-49622: netfilter: nf_tables: avoid skb access on nf_stolen

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-02-26 · updated 2026-10-30
Weakness: CWE-416

Description

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: avoid skb access on nf_stolen When verdict is NF_STOLEN, the skb might have been freed. When tracing is enabled, this can result in a use-after-free: 1. access to skb->nf_trace 2. access to skb->mark 3. computation of trace id 4. dump of packet payload To avoid 1, keep a cached copy of skb->nf_trace in the trace state struct. Refresh this copy whenever verdict is != STOLEN. Avoid 2 by skipping skb->mark access if verdict is STOLEN. 3 is avoided by precomputing the trace id. Only dump the packet when verdict is not "STOLEN".

Affected products

Linux kernel: before 5.18.13; 5.19-rc1, 5.19-rc2, 5.19-rc3, 5.19-rc4 — fixed in 5.18.13
Linux: 4.10 — fixed in 5.19

How to fix

Upgrade to a fixed version: Linux kernel 5.18.13; Linux 5.19. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-49622 or the next vulnerability affects your stack