What is the CVSS score of CVE-2022-2586?

CVE-2022-2586 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 2.3%.

Which versions of Linux Kernel are affected by CVE-2022-2586?

Ubuntu systems running versions 14.04 ESM through 22.04 LTS face an immediate privilege escalation risk from CVE-2022-2586, a kernel vulnerability allowing any local user to gain root access on…. A patch is available.

Is there a public PoC exploit available for CVE-2022-2586?

Yes, a public proof-of-concept exploit is available for CVE-2022-2586. Prioritise patching immediately. EPSS: 2.3%.

How to fix or mitigate CVE-2022-2586?

Within 24 hours, inventory all Ubuntu systems running versions 14.04 ESM through 22.04 LTS and verify the status of unprivileged user namespaces on each host by checking 'sysctl user.max_user_namespaces'. Within 7 days, apply the latest kernel security patches from Ubuntu for each affected distribution version (consult Ubuntu security advisories for your version to identify the specific patched kernel package) and schedule system reboots to activate the patched kernels. Within 30 days, complete kernel patching across all affected systems, verify patch deployment through kernel version validation, and evaluate whether unprivileged user namespaces can be disabled via sysctl configuration if not required for operational applications.

Linux Kernel CVE-2022-2586

HIGH

Use After Free (CWE-416)

2024-01-08 security@ubuntu.com

Information Disclosure Use After Free Memory Corruption Canonical Ubuntu Linux

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local attack vector with low privileges required; default user namespace support effectively lowers exploitation bar; full C/I/A impact via kernel heap corruption enabling root escalation.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Aug 13, 2026 - 19:44 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 13, 2026 - 19:37 vuln.today

cvss_changed

Severity Changed

Aug 13, 2026 - 19:37 NVD

MEDIUM HIGH

CVSS changed

Aug 13, 2026 - 19:37 NVD

5.3 (MEDIUM) 7.8 (HIGH)

Analysis Generated

Mar 28, 2026 - 19:34 vuln.today

Patch released

Mar 28, 2026 - 19:34 nvd

Patch available

Added to CISA KEV

Oct 28, 2025 - 13:34 cisa

CISA KEV

PoC Detected

Oct 28, 2025 - 13:34 vuln.today

Public exploit code

CVE Published

Jan 08, 2024 - 18:15 nvd

MEDIUM 5.3

DescriptionNVD

It was discovered that a nft object or expression could reference a nft set on a different nft table, leading to a use-after-free once that table was deleted.

AnalysisAI

Use-after-free in the Linux kernel's nftables subsystem allows local privilege escalation to root when a cross-table object or expression references an nft set that is subsequently freed upon table deletion. Confirmed actively exploited (CISA KEV) with publicly available exploit code, this flaw affects Linux kernel versions up to and including 6.0, with explicit Ubuntu distribution coverage spanning 14.04 ESM through 22.04 LTS. On systems where unprivileged user namespaces are enabled by default - including Ubuntu LTS releases - any local user can obtain the necessary capability to trigger the vulnerability without elevated account permissions.

Technical ContextAI

nftables is the Linux kernel's modern replacement for iptables, implemented within the kernel's netfilter framework and responsible for packet filtering, NAT, and stateful traffic inspection. The root cause (CWE-416, Use After Free) is a missing isolation enforcement between nft tables: an nft object or expression in one table is permitted to hold a reference to an nft set defined in a different table. When the table owning that set is deleted, the kernel frees the associated memory without invalidating the cross-table reference. The referencing object retains a dangling pointer into freed kernel heap memory. Subsequent kernel access to that pointer constitutes a use-after-free condition, enabling an attacker to corrupt kernel data structures and redirect execution to achieve arbitrary code execution in ring 0. CPE data confirms the affected component as cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* up to and including 6.0, alongside Ubuntu distributions from 14.04 ESM through 22.04 LTS. The patch was submitted to the netfilter-devel kernel mailing list by Thadeu Lima de Souza Cascardo of Canonical on August 9, 2022.

RemediationAI

The upstream fix is available as a patch submitted to the netfilter-devel kernel mailing list at https://lore.kernel.org/netfilter-devel/20220809170148.164591-1-cascardo@canonical.com/T/#t. Ubuntu users should apply the kernel updates documented in the applicable USN advisories - beginning with USN-5557-1 at https://ubuntu.com/security/notices/USN-5557-1 - for their respective release; exact patched kernel package versions per Ubuntu release should be obtained directly from those advisories, as specific version strings are not independently confirmed in available reference data. For systems where immediate patching is not possible, disabling unprivileged user namespaces via sysctl -w kernel.unprivileged_userns_clone=0 (or kernel.unprivileged_userns_clone=0 in /etc/sysctl.d/) eliminates the most accessible exploitation path, though this breaks sandboxed applications relying on namespace isolation such as Chromium, Firefox, and snap-based packages - evaluate workload impact before applying. Alternatively, deploying AppArmor or seccomp policies that restrict CAP_NET_ADMIN to authorized processes reduces exposure while preserving more functionality. Patching remains the only complete remediation.