Skip to content
Fencer Vulns
high 7.8

CVE-2022-50000 json

netfilter: flowtable: fix stuck flows on cleanup due to pending work

published 2025-06-18 16 mo ago modified 2026-08-05 3 mo ago also EUVD-2022-55279

cvss
7.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 16%
public exploits
0
none known

Summary

In the Linux kernel, the following vulnerability has been resolved:

netfilter: flowtable: fix stuck flows on cleanup due to pending work

To clear the flow table on flow table free, the following sequence normally happens in order:

1) gc_step work is stopped to disable any further stats/del requests. 2) All flow table entries are set to teardown state. 3) Run gc_step which will queue HW del work for each flow table entry. 4) Waiting for the above del work to finish (flush). 5) Run gc_step again, deleting all entries from the flow table. 6) Flow table is freed.

But if a flow table entry already has pending HW stats or HW add work step 3 will not queue HW del work (it will be skipped), step 4 will wait for the pending add/stats to finish, and step 5 will queue HW del work which might execute after freeing of the flow table.

To fix the above, this patch flushes the pending work, then it sets the teardown flag to all flows in the flowtable and it forces a garbage collector run to queue work to remove the flows from hardware, then it flushes this new pending work and (finally) it forces another garbage collector run to remove the entry from the software flowtable.

Stack trace: [47773.882335] BUG: KASAN: use-after-free in down_read+0x99/0x460 [47773.883634] Write of size 8 at addr ffff888103b45aa8 by task kworker/u20:6/543704 [47773.885634] CPU: 3 PID: 543704 Comm: kworker/u20:6 Not tainted 5.12.0-rc7+ #2 [47773.886745] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009) [47773.888438] Workqueue: nf_ft_offload_del flow_offload_work_handler [nf_flow_table] [47773.889727] Call Trace: [47773.890214] dump_stack+0xbb/0x107 [47773.890818] print_address_description.constprop.0+0x18/0x140 [47773.892990] kasan_report.cold+0x7c/0xd8 [47773.894459] kasan_check_range+0x145/0x1a0 [47773.895174] down_read+0x99/0x460 [47773.899706] nf_flow_offload_tuple+0x24f/0x3c0 [nf_flow_table] [47773.907137] flow_offload_work_handler+0x72d/0xbe0 [nf_flow_table] [47773.913372] process_one_work+0x8ac/0x14e0 [47773.921325] [47773.921325] Allocated by task 592159: [47773.922031] kasan_save_stack+0x1b/0x40 [47773.922730] __kasan_kmalloc+0x7a/0x90 [47773.923411] tcf_ct_flow_table_get+0x3cb/0x1230 [act_ct] [47773.924363] tcf_ct_init+0x71c/0x1156 [act_ct] [47773.925207] tcf_action_init_1+0x45b/0x700 [47773.925987] tcf_action_init+0x453/0x6b0 [47773.926692] tcf_exts_validate+0x3d0/0x600 [47773.927419] fl_change+0x757/0x4a51 [cls_flower] [47773.928227] tc_new_tfilter+0x89a/0x2070 [47773.936652] [47773.936652] Freed by task 543704: [47773.937303] kasan_save_stack+0x1b/0x40 [47773.938039] kasan_set_track+0x1c/0x30 [47773.938731] kasan_set_free_info+0x20/0x30 [47773.939467] __kasan_slab_free+0xe7/0x120 [47773.940194] slab_free_freelist_hook+0x86/0x190 [47773.941038] kfree+0xce/0x3a0 [47773.941644] tcf_ct_flow_table_cleanup_work

Original patch description and stack trace by Paul Blakey.

Patch / fix

  • Linux Linux 5.15.64, 5.19.6, 6.0
  • linux Debian 14, Debian 13, Debian 12 5.19.6-1

debian advisories DEBIAN-CVE-2022-50000

  • linux Ubuntu 22.04 LTS 5.15.0-53.59
  • linux-aws Ubuntu 22.04 LTS 5.15.0-1023.27
  • linux-gcp Ubuntu 22.04 LTS 5.15.0-1022.29
  • linux-gke Ubuntu 22.04 LTS 5.15.0-1020.25
  • linux-ibm Ubuntu 22.04 LTS 5.15.0-1018.21
  • linux-kvm Ubuntu 22.04 LTS 5.15.0-1021.26
  • linux-azure Ubuntu 22.04 LTS 5.15.0-1023.29
  • linux-gkeop Ubuntu 22.04 LTS 5.15.0-1008.12

ubuntu advisories UBUNTU-CVE-2022-50000

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • kernel RHEL 9 5.14.0-162.6.1.el9_1
  • perf RHEL 9 5.14.0-162.6.1.el9_1
  • bpftool RHEL 9 5.14.0-162.6.1.el9_1
  • kernel-core RHEL 9 5.14.0-162.6.1.el9_1
  • kernel-tools RHEL 9 5.14.0-162.6.1.el9_1
  • python3-perf RHEL 9 5.14.0-162.6.1.el9_1
  • kernel-modules RHEL 9 5.14.0-162.6.1.el9_1
  • kernel-zfcpdump RHEL 9 5.14.0-162.6.1.el9_1

red hat advisories RHSA-2025:15660RHSA-2022:8267RHSA-2023:2951RHSA-2023:0512RHSA-2023:0101

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-50000 updated cvss 7.0

kernel: netfilter: flowtable: fix stuck flows on cleanup due to pending work

  • Red Hat Enterprise Linux 8 kernel-rt, kernel-rt-kvm, kernel-rt-core, kernel-rt-modules, kernel-rt-debug-kvm, kernel-rt-debug-core, +6 more
    affected: no fix available
  • Red Hat CodeReady Linux Builder (v. 8) kernel-debuginfo-common-x86_64 4.18.0-425.10.1.el8_7, kernel-debuginfo-common-aarch64 4.18.0-425.10.1.el8_7, kernel-debuginfo-common-ppc64le 4.18.0-425.10.1.el8_7
    fixed: vendor fix RHSA-2023:0101
  • Red Hat CodeReady Linux Builder (v. 9) kernel-debuginfo-common-s390x 5.14.0-162.6.1.el9_1, kernel-debuginfo-common-x86_64 5.14.0-162.6.1.el9_1, kernel-debuginfo-common-aarch64 5.14.0-162.6.1.el9_1, kernel-debuginfo-common-ppc64le 5.14.0-162.6.1.el9_1
    fixed: vendor fix RHSA-2022:8267
  • Red Hat CodeReady Linux Builder EUS (v.9.0) kernel-debuginfo-common-s390x 5.14.0-70.43.1.el9_0, kernel-debuginfo-common-x86_64 5.14.0-70.43.1.el9_0, kernel-debuginfo-common-aarch64 5.14.0-70.43.1.el9_0, kernel-debuginfo-common-ppc64le 5.14.0-70.43.1.el9_0
    fixed: vendor fix RHSA-2023:0512
  • Red Hat Enterprise Linux AppStream (v. 9) perf 5.14.0-162.6.1.el9_1, kernel-devel-matched 5.14.0-162.6.1.el9_1, kernel-debug-devel-matched 5.14.0-162.6.1.el9_1, kernel-debuginfo-common-s390x 5.14.0-162.6.1.el9_1, kernel-zfcpdump-devel-matched 5.14.0-162.6.1.el9_1, kernel-debuginfo-common-x86_64 5.14.0-162.6.1.el9_1, +2 more
    fixed: vendor fix RHSA-2022:8267
  • Red Hat Enterprise Linux AppStream EUS (v.9.0) perf 5.14.0-70.43.1.el9_0, kernel-devel-matched 5.14.0-70.43.1.el9_0, kernel-debug-devel-matched 5.14.0-70.43.1.el9_0, kernel-debuginfo-common-s390x 5.14.0-70.43.1.el9_0, kernel-zfcpdump-devel-matched 5.14.0-70.43.1.el9_0, kernel-debuginfo-common-x86_64 5.14.0-70.43.1.el9_0, +2 more
    fixed: vendor fix RHSA-2023:0512
  • Red Hat Enterprise Linux BaseOS (v. 8) perf 4.18.0-425.10.1.el8_7, perf 4.18.0-477.10.1.el8_8, kernel 4.18.0-425.10.1.el8_7, kernel 4.18.0-477.10.1.el8_8, bpftool 4.18.0-425.10.1.el8_7, bpftool 4.18.0-477.10.1.el8_8, +36 more
    fixed: vendor fix RHSA-2023:0101
  • Red Hat Enterprise Linux BaseOS (v. 9) kernel 5.14.0-162.6.1.el9_1, bpftool 5.14.0-162.6.1.el9_1, kernel-core 5.14.0-162.6.1.el9_1, kernel-tools 5.14.0-162.6.1.el9_1, python3-perf 5.14.0-162.6.1.el9_1, kernel-modules 5.14.0-162.6.1.el9_1, +14 more
    fixed: vendor fix RHSA-2022:8267
show 5 more
  • Red Hat Enterprise Linux BaseOS AUS (v.8.4) perf 4.18.0-305.172.1.el8_4, kernel 4.18.0-305.172.1.el8_4, bpftool 4.18.0-305.172.1.el8_4, kernel-core 4.18.0-305.172.1.el8_4, kernel-tools 4.18.0-305.172.1.el8_4, python3-perf 4.18.0-305.172.1.el8_4, +8 more
    fixed: vendor fix RHSA-2025:15660
  • Red Hat Enterprise Linux BaseOS EUS (v.9.0) kernel 5.14.0-70.43.1.el9_0, bpftool 5.14.0-70.43.1.el9_0, kernel-core 5.14.0-70.43.1.el9_0, kernel-tools 5.14.0-70.43.1.el9_0, python3-perf 5.14.0-70.43.1.el9_0, kernel-modules 5.14.0-70.43.1.el9_0, +14 more
    fixed: vendor fix RHSA-2023:0512
  • Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4) perf 4.18.0-305.172.1.el8_4, kernel 4.18.0-305.172.1.el8_4, bpftool 4.18.0-305.172.1.el8_4, kernel-core 4.18.0-305.172.1.el8_4, kernel-tools 4.18.0-305.172.1.el8_4, python3-perf 4.18.0-305.172.1.el8_4, +8 more
    fixed: vendor fix RHSA-2025:15660
  • Red Hat Enterprise Linux CRB (v. 8) kernel-debuginfo-common-x86_64 4.18.0-477.10.1.el8_8, kernel-debuginfo-common-aarch64 4.18.0-477.10.1.el8_8, kernel-debuginfo-common-ppc64le 4.18.0-477.10.1.el8_8
    fixed: vendor fix RHSA-2023:2951
  • Red Hat Enterprise Linux 6 perf, kernel, python-perf, kernel-kdump, kernel-firmware, kernel-bootwrapper, +1 more Red Hat Enterprise Linux 7 perf, kernel, bpftool, kernel-rt, python-perf, kernel-kdump, +8 more Red Hat Enterprise Linux 9 kernel-rt, kernel-rt-kvm, kernel-rt-core, kernel-rt-modules, kernel-rt-debug-kvm, kernel-rt-debug-core, +12 more Red Hat Enterprise Linux 10 kernel Red Hat Enterprise Linux BaseOS AUS (v.8.4) kernel-doc 4.18.0-305.172.1.el8_4 Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4) kernel-doc 4.18.0-305.172.1.el8_4
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

0.25% chance of exploitation in the next 30 days, higher than 16% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD 3.1 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

  • Linux Linux

Classification

Weakness
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.