--- id: CVE-2022-2588 title: >- It was discovered that the cls_route filter implementation in the Linux kernel would not remove an old filter from the hashtable before freeing it if its handle had the value 0. summary: >- It was discovered that the cls_route filter implementation in the Linux kernel would not remove an old filter from the hashtable before freeing it if its handle had the value 0. severity: medium cvss: 5.3 cvssVector: 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H' cwe: - CWE-416 - CWE-415 vendor: linux product: linux_kernel affected: - linux_kernel < 4.9.326 - 'linux_kernel >= 4.10, < 4.14.291' - 'linux_kernel >= 4.15, < 4.19.256' - 'linux_kernel >= 4.20, < 5.4.211' - 'linux_kernel >= 5.5, < 5.10.137' - 'linux_kernel >= 5.11, < 5.15.61' - 'linux_kernel >= 5.16, < 5.18.18' - 'linux_kernel >= 5.19, < 5.19.2' - ubuntu_linux = 14.04 - ubuntu_linux = 16.04 - ubuntu_linux = 18.04 - ubuntu_linux = 20.04 - ubuntu_linux = 22.04 patched: - linux_kernel 5.19.2 published: '2024-01-08' updated: '2026-10-14' sourceUpdated: '2026-10-14T14:17:21.670' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2022-2588' references: - url: 'https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2588' label: security@ubuntu.com - url: 'https://github.com/Markakd/CVE-2022-2588' label: security@ubuntu.com - url: >- https://lore.kernel.org/netdev/20220809170518.164662-1-cascardo@canonical.com/T/#u label: security@ubuntu.com - url: 'https://ubuntu.com/security/notices/USN-5557-1' label: security@ubuntu.com - url: 'https://ubuntu.com/security/notices/USN-5560-1' label: security@ubuntu.com - url: 'https://ubuntu.com/security/notices/USN-5560-2' label: security@ubuntu.com - url: 'https://ubuntu.com/security/notices/USN-5562-1' label: security@ubuntu.com - url: 'https://ubuntu.com/security/notices/USN-5564-1' label: security@ubuntu.com - url: 'https://ubuntu.com/security/notices/USN-5565-1' label: security@ubuntu.com - url: 'https://ubuntu.com/security/notices/USN-5566-1' label: security@ubuntu.com - url: 'https://ubuntu.com/security/notices/USN-5567-1' label: security@ubuntu.com - url: 'https://ubuntu.com/security/notices/USN-5582-1' label: security@ubuntu.com - url: 'https://ubuntu.com/security/notices/USN-5588-1' label: security@ubuntu.com - url: 'https://www.openwall.com/lists/oss-security/2022/08/09/6' label: security@ubuntu.com - url: 'https://www.zerodayinitiative.com/advisories/ZDI-22-1117/' label: security@ubuntu.com - url: 'https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2588' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://github.com/Markakd/CVE-2022-2588' label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lore.kernel.org/netdev/20220809170518.164662-1-cascardo@canonical.com/T/#u label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://ubuntu.com/security/notices/USN-5557-1' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://ubuntu.com/security/notices/USN-5560-1' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://ubuntu.com/security/notices/USN-5560-2' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://ubuntu.com/security/notices/USN-5562-1' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://ubuntu.com/security/notices/USN-5564-1' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://ubuntu.com/security/notices/USN-5565-1' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://ubuntu.com/security/notices/USN-5566-1' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://ubuntu.com/security/notices/USN-5567-1' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://ubuntu.com/security/notices/USN-5582-1' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://ubuntu.com/security/notices/USN-5588-1' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.openwall.com/lists/oss-security/2022/08/09/6' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.zerodayinitiative.com/advisories/ZDI-22-1117/' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://cert-portal.siemens.com/productcert/html/ssa-419740.html' label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e - url: 'https://cert-portal.siemens.com/productcert/html/ssa-769027.html' label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e - url: 'https://cert-portal.siemens.com/productcert/html/ssa-794697.html' label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e - url: 'https://cert-portal.siemens.com/productcert/html/ssa-831302.html' label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e tags: - nvd - exploit-available - cve.org epss: 0.05871 epssPercentile: 0.93167 exploits: github: 9 githubRepos: - 'https://github.com/Markakd/CVE-2022-2588' - 'https://github.com/ASkyeye/2022-LPE-UAF' - 'https://github.com/pirenga/2022-LPE-UAF' checkedAt: '2026-10-27T16:41:27.194Z' exploitAvailable: true zeroDay: true ingestedAt: '2026-10-14T15:36:13.930Z' ssvc: exploitation: poc automatable: 'no' technicalImpact: partial timestamp: '2024-02-06T20:44:16.386267Z' --- ## Overview It was discovered that the cls_route filter implementation in the Linux kernel would not remove an old filter from the hashtable before freeing it if its handle had the value 0. ## Affected - `linux_kernel < 4.9.326` - `linux_kernel >= 4.10, < 4.14.291` - `linux_kernel >= 4.15, < 4.19.256` - `linux_kernel >= 4.20, < 5.4.211` - `linux_kernel >= 5.5, < 5.10.137` - `linux_kernel >= 5.11, < 5.15.61` - `linux_kernel >= 5.16, < 5.18.18` - `linux_kernel >= 5.19, < 5.19.2` - `ubuntu_linux = 14.04` - `ubuntu_linux = 16.04` - `ubuntu_linux = 18.04` - `ubuntu_linux = 20.04` - `ubuntu_linux = 22.04` ## Remediation Upgrade past the affected range: - `linux_kernel 5.19.2`