CVE-2022-49561
published 2025-02-26CVE-2022-49561: In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: re-fetch conntrack after insertion In case the conntrack is clashing…
PriorityP421medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.81%
53.3th percentile
In the Linux kernel, the following vulnerability has been resolved:
netfilter: conntrack: re-fetch conntrack after insertion
In case the conntrack is clashing, insertion can free skb->_nfct and
set skb->_nfct to the already-confirmed entry.
This wasn't found before because the conntrack entry and the extension
space used to free'd after an rcu grace period, plus the race needs
events enabled to trigger.
Affected
21 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 5.18.2-1 (bookworm) | linux 5.18.2-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= 71d8c47fc653711c41bc3282e5b0e605b3727956 < e97222b785e70e8973281666d709baad6523d8af | e97222b785e70e8973281666d709baad6523d8af |
| linux | linux | >= 71d8c47fc653711c41bc3282e5b0e605b3727956 < 92a999d1963eed0df666284e20055136ceabd12f | 92a999d1963eed0df666284e20055136ceabd12f |
| linux | linux | >= 71d8c47fc653711c41bc3282e5b0e605b3727956 < b16bb373988da3ceb0308381634117e18b6ec60d | b16bb373988da3ceb0308381634117e18b6ec60d |
| linux | linux | >= 71d8c47fc653711c41bc3282e5b0e605b3727956 < 91a36ec160ec1a0c8f5352b772dffcbb0b6023e3 | 91a36ec160ec1a0c8f5352b772dffcbb0b6023e3 |
| linux | linux | >= 71d8c47fc653711c41bc3282e5b0e605b3727956 < 01989d7eebb61c99bd4b88ebc8e261bd2f02caed | 01989d7eebb61c99bd4b88ebc8e261bd2f02caed |
| linux | linux | >= 71d8c47fc653711c41bc3282e5b0e605b3727956 < 04f9e9104c969d8ce10a4a43634f641ed082092d | 04f9e9104c969d8ce10a4a43634f641ed082092d |
| linux | linux | >= 71d8c47fc653711c41bc3282e5b0e605b3727956 < 04e4a11dc723c52db7a36dc58f0d69ce6426f8f0 | 04e4a11dc723c52db7a36dc58f0d69ce6426f8f0 |
| linux | linux | >= 71d8c47fc653711c41bc3282e5b0e605b3727956 < 56b14ecec97f39118bf85c9ac2438c5a949509ed | 56b14ecec97f39118bf85c9ac2438c5a949509ed |
| linux | linux_kernel | >= 0 < 5.10.120-1 | 5.10.120-1 |
| linux | linux_kernel | >= 0 < 5.18.2-1 | 5.18.2-1 |
| linux | linux_kernel | >= 0 < 5.18.2-1 | 5.18.2-1 |
| linux | linux_kernel | >= 0 < 5.18.2-1 | 5.18.2-1 |
| linux | linux_kernel | >= 4.15 < 4.19.246 | 4.19.246 |
| linux | linux_kernel | >= 4.20 < 5.4.197 | 5.4.197 |
| linux | linux_kernel | >= 4.7 < 4.14.282 | 4.14.282 |
| linux | linux_kernel | >= 5.11 < 5.15.45 | 5.15.45 |
| linux | linux_kernel | >= 5.16 < 5.17.13 | 5.17.13 |
| linux | linux_kernel | >= 5.18 < 5.18.2 | 5.18.2 |
| linux | linux_kernel | >= 5.5 < 5.10.120 | 5.10.120 |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.5MEDIUM
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: netfilter: conntrack: re-fetch conntrack after insertion
vendor_redhat·2025-02-26·CVSS 5.5
CVE-2022-49561 [MEDIUM] kernel: netfilter: conntrack: re-fetch conntrack after insertion
kernel: netfilter: conntrack: re-fetch conntrack after insertion
In the Linux kernel, the following vulnerability has been resolved:
netfilter: conntrack: re-fetch conntrack after insertion
In case the conntrack is clashing, insertion can free skb->_nfct and
set skb->_nfct to the already-confirmed entry.
This wasn't found before because the conntrack entry and the extension
space used to free'd after an rcu grace period, plus the race needs
events enabled to trigger.
Package: kernel (Red Hat Enterprise Linux 10) - Not affected
Package: kernel (Red Hat Enterprise Linux 6) - Out of support scope
Package: kernel (Red Hat Enterprise Linux 7) - Out of support scope
Package: kernel-rt (Red Hat Enterprise Linux 7) - Out of support scope
Package: kernel-rt (Red Hat Enterprise Linux 8) - Affe
Debian
CVE-2022-49561: linux - In the Linux kernel, the following vulnerability has been resolved: netfilter: ...
vendor_debian·2022·CVSS 5.5
CVE-2022-49561 [MEDIUM] CVE-2022-49561: linux - In the Linux kernel, the following vulnerability has been resolved: netfilter: ...
In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: re-fetch conntrack after insertion In case the conntrack is clashing, insertion can free skb->_nfct and set skb->_nfct to the already-confirmed entry. This wasn't found before because the conntrack entry and the extension space used to free'd after an rcu grace period, plus the race needs events enabled to trigger.
Scope: local
bookworm: resolved (fixed in 5.18.2-1)
bullseye: resolved (fixed in 5.10.120-1)
forky: resolved (fixed in 5.18.2-1)
sid: resolved (fixed in 5.18.2-1)
trixie: resolved (fixed in 5.18.2-1)
GHSA
GHSA-mwj5-hv79-wr7f: In the Linux kernel, the following vulnerability has been resolved:
netfilter: conntrack: re-fetch conntrack after insertion
In case the conntrack i
ghsa_unreviewed·2025-10-24
CVE-2022-49561 [MEDIUM] GHSA-mwj5-hv79-wr7f: In the Linux kernel, the following vulnerability has been resolved:
netfilter: conntrack: re-fetch conntrack after insertion
In case the conntrack i
In the Linux kernel, the following vulnerability has been resolved:
netfilter: conntrack: re-fetch conntrack after insertion
In case the conntrack is clashing, insertion can free skb->_nfct and
set skb->_nfct to the already-confirmed entry.
This wasn't found before because the conntrack entry and the extension
space used to free'd after an rcu grace period, plus the race needs
events enabled to trigger.
OSV
CVE-2022-49561: In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: re-fetch conntrack after insertion In case the conntrack is
osv·2025-02-26·CVSS 5.5
CVE-2022-49561 [MEDIUM] CVE-2022-49561: In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: re-fetch conntrack after insertion In case the conntrack is
In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: re-fetch conntrack after insertion In case the conntrack is clashing, insertion can free skb->_nfct and set skb->_nfct to the already-confirmed entry. This wasn't found before because the conntrack entry and the extension space used to free'd after an rcu grace period, plus the race needs events enabled to trigger.
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/01989d7eebb61c99bd4b88ebc8e261bd2f02caedhttps://git.kernel.org/stable/c/04e4a11dc723c52db7a36dc58f0d69ce6426f8f0https://git.kernel.org/stable/c/04f9e9104c969d8ce10a4a43634f641ed082092dhttps://git.kernel.org/stable/c/56b14ecec97f39118bf85c9ac2438c5a949509edhttps://git.kernel.org/stable/c/91a36ec160ec1a0c8f5352b772dffcbb0b6023e3https://git.kernel.org/stable/c/92a999d1963eed0df666284e20055136ceabd12fhttps://git.kernel.org/stable/c/b16bb373988da3ceb0308381634117e18b6ec60dhttps://git.kernel.org/stable/c/e97222b785e70e8973281666d709baad6523d8af
2025-02-26
Published