Actively exploited in the wild
Linux Kernel Use-After-Free Vulnerability
Linux - Kernel · Listed in the CISA KEV since 2024-06-26. This indicates confirmed attacks in production environments.
Required action: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.
CVE-2022-2586
MediumCVSS 5.3KEVExploitation Probability (EPSS)
Very high risk95th percentile - higher than 95% of all known CVEs
Summary
It was discovered that an nft object or expression could reference an nft set in a different nft table, leading to a use-after-free once that table was deleted.
Risk Assessment
The vulnerability may lead to memory corruption, potentially allowing an attacker to execute code or cause a system crash.
Recommendation
Apply Linux kernel updates that include the fix for CVE-2022-2586.
Original NVD description (English source)
It was discovered that a nft object or expression could reference a nft set on a different nft table, leading to a use-after-free once that table was deleted.