CVE-2022-2586: Linux Kernel Use-After-Free Vulnerability

High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2024-06-26. EPSS: 10.2% chance of exploitation in the next 30 days.

It was discovered that a nft object or expression could reference a nft set on a different nft table, leading to a use-after-free once that table was deleted.

Affected products

• Canonical Ubuntu Linux: version 14.04 only; version 16.04 only; version 18.04 only; version 20.04 only; version 22.04 only
• Linux Linux Kernel: from 3.16, before 4.14.316 (fixed in 4.14.316); from 4.15, before 4.19.256 (fixed in 4.19.256); from 4.20, before 5.4.211 (fixed in 5.4.211); from 5.5, before 5.10.137 (fixed in 5.10.137); from 5.11, before 5.15.61 (fixed in 5.15.61); from 5.16, before 5.18.18 (fixed in 5.18.18); …

Published 2024-01-08. Last modified 2026-08-20.