cyfenced.com →

[ CVE-2022-2586 · Published 8 Jan 2024 ]

Linux Kernel Use-After-Free Vulnerability

Exploited · CISA KEV CVSS 7.8 EPSS 10%Fix available

[ Why it matters ]Priority signals

  • Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2024-06-26
  • EPSS: 10% chance of exploitation in the next 30 days (higher than 96% of CVEs)

[ Description ]Official description

It was discovered that a nft object or expression could reference a nft set on a different nft table, leading to a use-after-free once that table was deleted.

CISA: Linux Kernel contains a use-after-free vulnerability in the nft_object, allowing local attackers to escalate privileges.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 17 Jul 2024): Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.

[ References ]References