CVE-2022-2586

CVE-2022-2586 is a use-after-free (CWE-416) in the Linux kernel's netfilter/nftables subsystem, where an nft object or expression can reference an nft set belonging to a different nft table. When that other table is deleted, the reference becomes stale and the kernel accesses freed memory, which a local low-privileged user can leverage for privilege escalation and full compromise of the host (CVSS 3.1: 7.8, AV:L/PR:L with high confidentiality, integrity and availability impact). Any Linux deployment whose kernel carries the vulnerable nftables code is affected, including distributions such as Ubuntu Linux (Canonical is the assigned CNA). Exploitation is local, so internet-facing exposure matters mainly as a means for an attacker to first gain a local foothold. The bug is under active exploitation — CISA added it to the Known Exploited Vulnerabilities catalog on 2024-06-26 — and a public write-up with proof-of-concept material exists, with EPSS estimating a 10.5% chance of exploitation within 30 days.

What to do: Apply kernel updates per vendor instructions — on Ubuntu, install the latest linux/linux-* packages for your release and reboot to load the patched kernel (per the CISA KEV required action, treating this as a priority item given confirmed in-the-wild exploitation). As interim mitigation, limit unprivileged users' ability to create nftables objects (e.g., restrict unprivileged user namespaces) and review local accounts on multi-user hosts; identify affected systems by checking kernel versions against your distribution's security advisories.