CVE-2022-1998 — Use After Free in Linux Kernel

Vendor	Product	Version range	Fixed in
debian	linux	< linux 5.16.7-1 (bookworm)	linux 5.16.7-1 (bookworm)
fedoraproject	fedora	—	—
linux	linux_kernel	—	—
linux	linux_kernel	>= 0 < 5.10.103-1	5.10.103-1
linux	linux_kernel	>= 0 < 5.16.7-1	5.16.7-1
linux	linux_kernel	>= 0 < 5.16.7-1	5.16.7-1
linux	linux_kernel	>= 0 < 5.16.7-1	5.16.7-1
linux	linux_kernel	>= 0 < 4.4.0-253.287	4.4.0-253.287
linux	linux_kernel	>= 5.10.46 < 5.10.97	5.10.97
linux	linux_kernel	>= 5.12.12 < 5.15.20	5.15.20
linux	linux_kernel	>= 5.16.0 < 5.16.6	5.16.6
msrc	cbl2_kernel_5.15.48.1-2_on_cbl_mariner_2.0	—	—
msrc	cm1_kernel_5.10.123.1-1_on_cbl_mariner_1.0	—	—
redhat	enterprise_linux	—	—

Red Hat

kernel: clean up hook list when offload flags check fails

vendor_redhat·2024-05-03·CVSS 5.5

CVE-2022-48691 [MEDIUM] kernel: clean up hook list when offload flags check fails kernel: clean up hook list when offload flags check fails In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: clean up hook list when offload flags check fails splice back the hook list so nft_chain_release_hook() has a chance to release the hooks. BUG: memory leak unreferenced object 0xffff88810180b100 (size 96): comm "syz-executor133", pid 3619, jiffies 4294945714 (age 12.690s) hex dump (first 32 bytes): 28 64 23 02 81 88 ff ff 28 64 23 02 81 88 ff ff (d#.....(d#..... 90 a8 aa 83 ff ff ff ff 00 00 b5 0f 81 88 ff ff ................ backtrace: [] kmalloc include/linux/slab.h:600 [inline] [] nft_netdev_hook_alloc+0x3b/0xc0 net/netfilter/nf_tables_api.c:1901 [] nft_chain_parse_netdev net/netfilter/nf_tables_api.c:1998 [inline] [] nft_chain_parse_hook+0

Microsoft

A use after free in the Linux kernel File System notify functionality was found in the way user triggers copy_info_records_to_user() call to fail in copy_event_to_user(). A local user could use this f

vendor_msrc·2022-06-14·CVSS 7.8

CVE-2022-1998 [HIGH] CWE-416 A use after free in the Linux kernel File System notify functionality was found in the way user triggers copy_info_records_to_user() call to fail in copy_event_to_user(). A local user could use this f A use after free in the Linux kernel File System notify functionality was found in the way user triggers copy_info_records_to_user() call to fail in copy_event_to_user(). A local user could use this flaw to crash the system or potentially escalate their privileges on the system. FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more

Red Hat

kernel: fanotify misuses fd_install() which could lead to use-after-free

vendor_redhat·2022-01-27·CVSS 7.8

CVE-2022-1998 [HIGH] CWE-416 kernel: fanotify misuses fd_install() which could lead to use-after-free kernel: fanotify misuses fd_install() which could lead to use-after-free A use after free in the Linux kernel File System notify functionality was found in the way user triggers copy_info_records_to_user() call to fail in copy_event_to_user(). A local user could use this flaw to crash the system or potentially escalate their privileges on the system. A use-after-free flaw was found in the Linux kernel’s File System notify functionality in the way a user triggers the copy_info_records_to_user() function call to fail in copy_event_to_user(). This flaw allows a local user to crash or potentially escalate their privileges on the system. Package: kernel (Red Hat Enterprise Linux 6) - Not affected Package: kernel (Red Hat Enterprise Linux 7) - Not affected Package: kernel-rt (Red Hat Enterp

Debian

CVE-2022-1998: linux - A use after free in the Linux kernel File System notify functionality was found ...

vendor_debian·2022·CVSS 7.8

CVE-2022-1998 [HIGH] CVE-2022-1998: linux - A use after free in the Linux kernel File System notify functionality was found ... A use after free in the Linux kernel File System notify functionality was found in the way user triggers copy_info_records_to_user() call to fail in copy_event_to_user(). A local user could use this flaw to crash the system or potentially escalate their privileges on the system. Scope: local bookworm: resolved (fixed in 5.16.7-1) bullseye: resolved (fixed in 5.10.103-1) forky: resolved (fixed in 5.16.7-1) sid: resolved (fixed in 5.16.7-1) trixie: resolved (fixed in 5.16.7-1)

OSV

linux, linux-aws, linux-kvm, linux-lts-xenial vulnerabilities

osv·2024-04-19·CVSS 7.0

CVE-2022-20422 linux, linux-aws, linux-kvm, linux-lts-xenial vulnerabilities linux, linux-aws, linux-kvm, linux-lts-xenial vulnerabilities It was discovered that a race condition existed in the instruction emulator of the Linux kernel on Arm 64-bit systems. A local attacker could use this to cause a denial of service (system crash). (CVE-2022-20422) Wei Chen discovered that a race condition existed in the TIPC protocol implementation in the Linux kernel, leading to a null pointer dereference vulnerability. A local attacker could use this to cause a denial of service (system crash). (CVE-2023-1382) Jose Oliveira and Rodrigo Branco discovered that the Spectre Variant 2 mitigations with prctl syscall were insufficient in some situations. A local attacker could possibly use this to expose sensitive information. (CVE-2023-1998) Daniele Antonioli discovered that the

GHSA

GHSA-2789-cv5q-pwgx: A use after free in the Linux kernel File System notify functionality was found in the way user triggers copy_info_records_to_user() call to fail in c

ghsa_unreviewed·2022-06-10

CVE-2022-1998 [HIGH] CWE-416 GHSA-2789-cv5q-pwgx: A use after free in the Linux kernel File System notify functionality was found in the way user triggers copy_info_records_to_user() call to fail in c A use after free in the Linux kernel File System notify functionality was found in the way user triggers copy_info_records_to_user() call to fail in copy_event_to_user(). A local user could use this flaw to crash the system or potentially escalate their privileges on the system.

OSV

CVE-2022-1998: A use after free in the Linux kernel File System notify functionality was found in the way user triggers copy_info_records_to_user() call to fail in c

osv·2022-06-09·CVSS 7.8

CVE-2022-1998 [HIGH] CVE-2022-1998: A use after free in the Linux kernel File System notify functionality was found in the way user triggers copy_info_records_to_user() call to fail in c A use after free in the Linux kernel File System notify functionality was found in the way user triggers copy_info_records_to_user() call to fail in copy_event_to_user(). A local user could use this flaw to crash the system or potentially escalate their privileges on the system.

CVE-2022-1998: A use after free in the Linux kernel File System notify functionality was found in the way user triggers copy_info_records_to_user() call to fail in…

Affected

CVSS provenance