Vulnerability Intelligence Report
Linux Kernel Use-After-Free Vulnerability
CVE-2022-2586
It was discovered that a nft object or expression could reference a nft set on a different nft table, leading to a use-after-free once that table was deleted.
CISA KEV
SSVC: Active Exploitation
CVSS Base Score
5.3
MEDIUM
Exploitability:1.1
Impact Score:4.3
EPSS Probability:10.46%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-416 ↗CWE-416
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| The Linux Kernel Organization | linux | 3.16 < 4.14.316 (affected), 4.15 < 4.19.256 (affected), 4.20 < 5.4.211 (affected), 5.5 < 5.10.137 (affected), 5.11 < 5.15.61 (affected), 5.16 < 5.18.18 (affected), 5.19 < 5.19.2 (affected) |
Threat Intelligence Signals
CISA KEV
ACTIVE IN CATALOG
EPSS Score
10.458%
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | Canonical Ltd. · Vendor · UK |
| Reserved | 2022-07-29T22:01:19 |
| Published | 2024-01-08T17:46:06 |
| Last Updated | 2026-08-20T13:57:32 |
Community Chatter & Buzz