CVE-2022-3524: Linux Kernel IPv6 ipv6_renew_options memory leak
Vulnerability summary
CVE-2022-3524 is a medium (CVSS 5.5) Improper Resource Shutdown or Release vulnerability in debian debian_linux. EPSS estimates a 1.09% chance of exploitation in the next 30 days, higher than 65.4% of scored vulnerabilities.
Not severe (CVSS 4.3, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 39 · Related 30Timeline
- 16-10-2022PublishedVulnerability first disclosed.
- 14-10-2026Last modifiedVulnerability information updated.
Description
A vulnerability was found in Linux Kernel. It has been declared as problematic. Affected by this vulnerability is the function ipv6_renew_options of the component IPv6 Handler. The manipulation leads to memory leak. The attack can be launched remotely. It is recommended to apply a patch to fix this issue. The identifier VDB-211021 was assigned to this vulnerability.
CVSS metrics
5 scores · 4 sources · 2 versions- CVE.orgCNA4.3MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:LDiffers
- OSV · UbuntuEcosystem advisory · calculated4.3MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:LDiffers
- OSV · DebianEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
1.09%
Chance of exploitation in the next 30 days
Percentile
65%
Versus all other CVEs
30-day change
Increase +0.27 pp
From 0.82% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-404Improper Resource Shutdown or ReleaseThe product does not release or incorrectly releases a resource before it is made available for re-use.
- CWE-401Missing Release of Memory after Effective LifetimeThe product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.
Affected systems
Known conditions: network-reachable, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Ubuntu93 products
- linuxAll versions (No fix recorded) | < 4.4.0-235.269 | < 4.15.0-200.211 | < 5.4.0-135.152 | < 5.15.0-56.62
- linux-aws< 4.4.0-1114.120 | < 4.4.0-1152.167 | < 4.15.0-1146.158 | < 5.4.0-1092.100 | < 5.15.0-1026.30
- linux-aws-5.0All versions (No fix recorded)
- linux-aws-5.11All versions (No fix recorded)
- linux-aws-5.13All versions (No fix recorded)
Debian2 products
- linux< 6.0.7-1
- debian_linuxEOL10.0
Linux2 products
- kerneln/a
- linux_kernel< 2.6.12 | 2.6.12 | 2.6.12:rc1
3 vendors · 97 products
