CVE-2022-2586: Linux Kernel Use-After-Free Vulnerability

KEV

Analyzed

AliasesUBUNTU-CVE-2022-2586DEBIAN-CVE-2022-2586

Published 08-01-2024Last modified 14-10-2026

Vulnerability summary

CVE-2022-2586 is a high (CVSS 7.8) Use After Free vulnerability in Linux Kernel. It is known to be exploited: CISA lists it, first on 26-06-2024. EPSS estimates a 10.20% chance of exploitation in the next 30 days, higher than 95.6% of scored vulnerabilities. 1 public exploit is recorded.

Priority

Act nowlisted as exploited

Listed as exploited by CISA (26-06-2024)

Source freshness unavailable

How is this decided?

CVSS score

7.8/10

010

High · v3.1 (NVD)

EPSS score

10.20%

0%100%

Medium · 0.00 pp in 30 days

KEVExploited in the wildCritical · listed in 1 catalog

RansomwareNot flaggedNo ransomware use recorded.

Public exploits1reference

Timeline

08-01-2024
PublishedVulnerability first disclosed.
26-06-2024
Added to CISA KEVExploitedLinux Kernel Use-After-Free Vulnerability
17-07-2024
CISA remediation dueDeadline passedApply updates per vendor instructions or discontinue use of the product if updates are unavailable.
14-10-2026
Last modifiedVulnerability information updated.

Description

It was discovered that a nft object or expression could reference a nft set on a different nft table, leading to a use-after-free once that table was deleted.

CVSS metrics

4 scores · 4 sources · 1 version

v3.17.8

EPSS trend

Probability

10.20%

Chance of exploitation in the next 30 days

Percentile

96%

Versus all other CVEs

30-day change

No change 0.00 pp

From 10.20% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEVListed

Added: 26-06-2024
Federal due date: 17-07-2024

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

CISA required action

Apply updates per vendor instructions or discontinue use of the product if updates are unavailable. nvd.nist.gov/vuln/detail/CVE-2022-2586

Public exploits

1 found

referenceUnverified
Exploit Reference (vicarius.io)
Maturity: unknown

Weaknesses

CWE · root cause

CWE-416Use After FreeThe product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Affected systems

Version check

Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.

Ubuntu82 products

linux< 4.4.0-231.265 | < 4.15.0-191.202 | < 5.4.0-124.140 | < 5.15.0-46.49
linux-aws< 4.4.0-1111.117 | < 4.4.0-1147.162 | < 4.15.0-1139.150 | < 5.4.0-1083.90 | < 5.15.0-1017.21
linux-aws-5.0All versions (No fix recorded)
linux-aws-5.11All versions (No fix recorded)
linux-aws-5.13All versions (No fix recorded)

linux-aws-5.15< 5.15.0-1017.21~20.04.1
linux-aws-5.3All versions (No fix recorded)
linux-aws-5.4< 5.4.0-1083.90~18.04.1
linux-aws-5.8All versions (No fix recorded)
linux-aws-fips< 4.15.0-2078.83 | All versions (No fix recorded) | < 5.4.0-1083.90+fips1
linux-aws-hwe< 4.15.0-1139.150~16.04.1
linux-azure< 4.15.0-1149.164~14.04.1 | < 4.15.0-1149.164~16.04.1 | All versions (No fix recorded) | < 5.4.0-1089.94 | < 5.15.0-1017.20
linux-azure-4.15< 4.15.0-1149.164
linux-azure-5.11All versions (No fix recorded)
linux-azure-5.13All versions (No fix recorded)
linux-azure-5.15< 5.15.0-1017.20~20.04.1
linux-azure-5.3All versions (No fix recorded)
linux-azure-5.4< 5.4.0-1089.94~18.04.1
linux-azure-5.8All versions (No fix recorded)
linux-azure-edgeAll versions (No fix recorded)
linux-azure-fips< 4.15.0-2059.65 | All versions (No fix recorded) | < 5.4.0-1089.94+fips1
linux-bluefield< 5.4.0-1044.49
linux-dell300x< 4.15.0-1051.56
linux-fips< 4.4.0-1081.88 | All versions (No fix recorded) | < 4.15.0-1096.107 | < 5.4.0-1059.67
linux-gcp< 4.15.0-1134.150~16.04.2 | All versions (No fix recorded) | < 5.4.0-1086.94 | < 5.15.0-1016.21
linux-gcp-4.15< 4.15.0-1134.150
linux-gcp-5.11All versions (No fix recorded)
linux-gcp-5.13All versions (No fix recorded)
linux-gcp-5.15< 5.15.0-1016.21~20.04.1
linux-gcp-5.3All versions (No fix recorded)
linux-gcp-5.4< 5.4.0-1086.94~18.04.1
linux-gcp-5.8All versions (No fix recorded)
linux-gcp-fips< 4.15.0-2043.48 | All versions (No fix recorded) | < 5.4.0-1086.94+fips1
linux-gke< 5.4.0-1080.86 | < 5.15.0-1014.17
linux-gke-4.15All versions (No fix recorded)
linux-gke-5.15< 5.15.0-1014.17~20.04.1
linux-gke-5.4< 5.4.0-1080.86~18.04.1
linux-gkeop< 5.4.0-1051.54 | < 5.15.0-1002.4
linux-gkeop-5.4< 5.4.0-1051.54~18.04.1
linux-hwe< 4.15.0-191.202~16.04.1 | All versions (No fix recorded)
linux-hwe-5.11All versions (No fix recorded)
linux-hwe-5.13All versions (No fix recorded)
linux-hwe-5.15< 5.15.0-46.49~20.04.1
linux-hwe-5.4< 5.4.0-124.140~18.04.1
linux-hwe-5.8All versions (No fix recorded)
linux-hwe-edgeAll versions (No fix recorded)
linux-ibm< 5.4.0-1031.35 | < 5.15.0-1012.14
linux-ibm-5.4< 5.4.0-1031.35~18.04.1
linux-intel-5.13All versions (No fix recorded)
linux-intel-iot-realtimeAll versions (No fix recorded)
linux-intel-iotg< 5.15.0-1013.17
linux-intel-iotg-5.15< 5.15.0-1015.20~20.04.2
linux-iot< 5.4.0-1004.6
linux-kvm< 4.4.0-1112.122 | < 4.15.0-1125.130 | < 5.4.0-1073.78 | < 5.15.0-1016.19
linux-lowlatency< 5.15.0-46.49
linux-lowlatency-hwe-5.15< 5.15.0-46.49~20.04.1
linux-lts-xenial< 4.4.0-231.265~14.04.1
linux-nvidia< 5.15.0-1007.7
linux-oemAll versions (No fix recorded)
linux-oem-5.10All versions (No fix recorded)
linux-oem-5.13All versions (No fix recorded)
linux-oem-5.14< 5.14.0-1048.55
linux-oem-5.17< 5.17.0-1015.16
linux-oem-5.6All versions (No fix recorded)
linux-oracle< 4.15.0-1104.115~16.04.1 | < 4.15.0-1104.115 | < 5.4.0-1081.89 | < 5.15.0-1016.20
linux-oracle-5.0All versions (No fix recorded)
linux-oracle-5.11All versions (No fix recorded)
linux-oracle-5.13All versions (No fix recorded)
linux-oracle-5.15< 5.15.0-1016.20~20.04.1
linux-oracle-5.3All versions (No fix recorded)
linux-oracle-5.4< 5.4.0-1081.89~18.04.1
linux-oracle-5.8All versions (No fix recorded)
linux-raspi< 5.4.0-1068.78 | < 5.15.0-1013.15
linux-raspi-5.4< 5.4.0-1068.78~18.04.1
linux-raspi-realtimeAll versions (No fix recorded)
linux-raspi2< 4.15.0-1117.125 | All versions (No fix recorded)
linux-realtimeAll versions (No fix recorded) | < 5.15.0-1019.19
linux-riscvAll versions (No fix recorded) | < 5.15.0-1017.19
linux-riscv-5.11All versions (No fix recorded)
linux-riscv-5.15< 5.15.0-1017.19~20.04.1
linux-riscv-5.8All versions (No fix recorded)
linux-snapdragon< 4.15.0-1135.145

Show all 82

Siemens2 products

simatic_s7-1500_tm_mfp_firmware< 1.1
sinec_os< 2.4

Canonical1 product

ubuntu_linuxEOL14.04 | 16.04 | 18.04 | 20.04 | 22.04

Debian1 product

linux< 5.18.16-1

Linux1 product

linux_kernel≥ 3.16, < 4.14.316 | ≥ 4.15, < 4.19.256 | ≥ 4.20, < 5.4.211 | ≥ 5.5, < 5.10.137 | ≥ 5.11, < 5.15.61 | ≥ 5.16, < 5.18.18 | ≥ 5.19, < 5.19.2

The linux kernel organization1 product

linux≥ 3.16, < 4.14.316 | ≥ 4.15, < 4.19.256 | ≥ 4.20, < 5.4.211 | ≥ 5.5, < 5.10.137 | ≥ 5.11, < 5.15.61 | ≥ 5.16, < 5.18.18 | ≥ 5.19, < 5.19.2

6 vendors · 88 products

References

22 links

ubuntu.com/security/notices/USN-5564-1Third Party AdvisoryAdvisory
ubuntu.com/security/notices/USN-5560-2Third Party AdvisoryAdvisory
ubuntu.com/security/notices/USN-5582-1Third Party AdvisoryAdvisory
ubuntu.com/security/notices/USN-5567-1Third Party AdvisoryAdvisory
ubuntu.com/security/notices/USN-5560-1Third Party AdvisoryAdvisory
ubuntu.com/security/notices/USN-5566-1Third Party AdvisoryAdvisory
www.openwall.com/lists/oss-security/2022/08/09/5Issue TrackingREPORTMailing List
ubuntu.com/security/notices/USN-5565-1Third Party AdvisoryAdvisory
www.zerodayinitiative.com/advisories/ZDI-22-1118/Issue TrackingREPORTThird Party AdvisoryVDB Entry
lore.kernel.org/netfilter-devel/20220809170148.164591-1-cascardo@canonical.com/T/Issue TrackingREPORTMailing ListPatch

Show all 22 references

ubuntu.com/security/notices/USN-5562-1Third Party AdvisoryAdvisory
ubuntu.com/security/notices/USN-5557-1Third Party AdvisoryAdvisory
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2586Issue TrackingThird Party Advisory
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-2586Government ResourceUS Government Resource
www.vicarius.io/vsociety/…ExploitThird Party Advisory
ubuntu.com/security/CVE-2022-2586REPORT
www.cve.org/CVERecord?id=CVE-2022-2586REPORT
www.cisa.gov/known-exploited-vulnerabilities-catalogREPORT
security-tracker.debian.org/tracker/CVE-2022-2586Advisory
nvd.nist.gov/vuln/detail/CVE-2022-2586OvalAdvisory
cert-portal.siemens.com/productcert/html/ssa-794697.htmlThird Party Advisory
cert-portal.siemens.com/productcert/html/ssa-806742.htmlThird Party Advisory