{"id":"CVE-2022-49622","title":"netfilter: nf_tables: avoid skb access on nf_stolen","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: avoid skb access on nf_stolen\n\nWhen verdict is NF_STOLEN, the skb might have been freed.\n\nWhen tracing is enabled, this can result in a use-after-…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= 5efa0fc6d7f7930b18801f07cefae8eeacd6ac02 < 348218a4601e93de4d1e9fab29837cf656e4bf99","Linux >= 5efa0fc6d7f7930b18801f07cefae8eeacd6ac02 < 453a67af8bd77463b33cb0336dd7f2341e332d29","Linux >= 5efa0fc6d7f7930b18801f07cefae8eeacd6ac02 < 0016d5d46d7440729a3132f61a8da3bf7f84e2ba","Linux >= 5efa0fc6d7f7930b18801f07cefae8eeacd6ac02 < e34b9ed96ce3b06c79bf884009b16961ca478f87","Linux 4.10"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2025-02-27T18:15:30.357017Z"},"published":"2025-02-26","updated":"2026-10-30","sourceUpdated":"2026-10-30T12:17:07.220Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2022-49622","references":[{"url":"https://git.kernel.org/stable/c/348218a4601e93de4d1e9fab29837cf656e4bf99"},{"url":"https://git.kernel.org/stable/c/453a67af8bd77463b33cb0336dd7f2341e332d29"},{"url":"https://git.kernel.org/stable/c/0016d5d46d7440729a3132f61a8da3bf7f84e2ba"},{"url":"https://git.kernel.org/stable/c/e34b9ed96ce3b06c79bf884009b16961ca478f87"}],"tags":["cve.org"],"epss":0.00273,"epssPercentile":0.19837,"ingestedAt":"2026-11-03T11:43:15.778Z","slug":"CVE-2022-49622","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: avoid skb access on nf_stolen\n\nWhen verdict is NF_STOLEN, the skb might have been freed.\n\nWhen tracing is enabled, this can result in a use-after-free:\n1. access to skb->nf_trace\n2. access to skb->mark\n3. computation of trace id\n4. dump of packet payload\n\nTo avoid 1, keep a cached copy of skb->nf_trace in the\ntrace state struct.\nRefresh this copy whenever verdict is != STOLEN.\n\nAvoid 2 by skipping skb->mark access if verdict is STOLEN.\n\n3 is avoided by precomputing the trace id.\n\nOnly dump the packet when verdict is not \"STOLEN\".\n\n## Affected\n\n- `Linux >= 5efa0fc6d7f7930b18801f07cefae8eeacd6ac02 < 348218a4601e93de4d1e9fab29837cf656e4bf99`\n- `Linux >= 5efa0fc6d7f7930b18801f07cefae8eeacd6ac02 < 453a67af8bd77463b33cb0336dd7f2341e332d29`\n- `Linux >= 5efa0fc6d7f7930b18801f07cefae8eeacd6ac02 < 0016d5d46d7440729a3132f61a8da3bf7f84e2ba`\n- `Linux >= 5efa0fc6d7f7930b18801f07cefae8eeacd6ac02 < e34b9ed96ce3b06c79bf884009b16961ca478f87`\n- `Linux 4.10`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}