CVE-2022-36879: Debian Linux

Medium severity, CVSS 5.5. EPSS: 0.3% chance of exploitation in the next 30 days.

An issue was discovered in the Linux kernel through 5.18.14. xfrm_expand_policies in net/xfrm/xfrm_policy.c can cause a refcount to be dropped twice.

Affected products

• Debian Debian Linux: version 10.0 only; version 11.0 only
• Linux Linux Kernel: up to and including 5.18.14
• Netapp a700s Firmware: affected versions not specified
• Netapp Active Iq Unified Manager: affected versions not specified
• Netapp Aff 500f Firmware: affected versions not specified
• Netapp Aff 8300 Firmware: affected versions not specified
• Netapp Aff 8700 Firmware: affected versions not specified
• Netapp Aff a250 Firmware: affected versions not specified
• Netapp Aff a400 Firmware: affected versions not specified
• Netapp E-Series Santricity OS Controller: from 11.0, up to and including 11.50.2
• Netapp Fas 500f Firmware: affected versions not specified
• Netapp Fas 8300 Firmware: affected versions not specified
• Netapp Fas 8700 Firmware: affected versions not specified
• Netapp Fas a250 Firmware: affected versions not specified
• Netapp Fas a400 Firmware: affected versions not specified
• Netapp h300s Firmware: affected versions not specified
• Netapp h410c Firmware: affected versions not specified
• Netapp h410s Firmware: affected versions not specified
• Netapp h500s Firmware: affected versions not specified
• Netapp h610c Firmware: affected versions not specified
• Netapp h610s Firmware: affected versions not specified
• Netapp h615c Firmware: affected versions not specified
• Netapp h700s Firmware: affected versions not specified
• Netapp Hci Bootstrap OS: affected versions not specified

Published 2022-07-27. Last modified 2026-06-17.