CVE-2022-50048: netfilter: nf_tables: possible module reference underflow in error path

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-06-18 · updated 2026-08-04

Description

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: possible module reference underflow in error path dst->ops is set on when nft_expr_clone() fails, but module refcount has not been bumped yet, therefore nft_expr_destroy() leads to module reference underflow.

Affected products

Linux kernel: from 5.11 before 5.15.63; from 5.16 before 5.19.4; 6.0-rc1 — fixed in 5.15.63, 5.19.4

How to fix

Upgrade to a fixed version: Linux kernel 5.15.63, 5.19.4. Check the vendor advisory for mitigations.

References

https://git.kernel.org/stable/c/1e52e6cfec6342c3d0df47dc3a76724fb3dabf56
https://git.kernel.org/stable/c/b59bee8b05b0e789b5a298cacb09e8aaa3367a29
https://git.kernel.org/stable/c/c485c35ff6783ccd12c160fcac6a0e504e83e0bf

Get alerted when CVE-2022-50048 or the next vulnerability affects your stack