Linux Kernel CVE-2022-2586
HIGHAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconGain unprivileged local shell access
-
DeliveryCreate user namespace to self-grant CAP_NET_ADMIN
-
ExploitCraft nft cross-table set reference
-
InstallDelete the referenced nft table to free memory
-
C2Trigger use-after-free via dangling cross-table pointer
-
ExecuteCorrupt kernel heap structures
-
ImpactEscalate to root
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a local shell account on the target Linux system. On Ubuntu 20.04 LTS, 22.04 LTS, and other distributions that enable unprivileged user namespaces by default, any unprivileged local user can self-grant CAP_NET_ADMIN within a user namespace - no sudo, no special group membership, and no administrator action is required beyond having a local account. The specific triggering condition is the ability to create nft objects or expressions that hold cross-table references to nft sets, and then delete the table that owns the referenced set. Environments where unprivileged user namespaces are disabled (kernel.unprivileged_userns_clone=0) require a local account with explicit CAP_NET_ADMIN capability, raising the exploitation bar to users with network administration privileges. Remote exploitation is not possible without a prior code-execution foothold on the target host. |
| Impact | The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H accurately characterizes this as a low-complexity local privilege escalation with no user interaction needed and full C/I/A impact - a 7.8 score that genuinely reflects the exploitation difficulty and consequence. The EPSS score of 2.28% appears modest in absolute terms, but sitting at the 85th percentile places this well above the noise floor of unexercised CVEs; combined with CISA KEV confirmation and a publicly circulating exploit, the probability of encountering active exploitation in enterprise environments is real. Critically, on Ubuntu 20.04 LTS and 22.04 LTS - where unprivileged user namespaces are enabled by default - the PR:L bar effectively collapses to any shell-level local user, since they can self-grant CAP_NET_ADMIN inside a user namespace without any administrative action. Even a mid-sized municipal IT team in gliwice managing a standard Ubuntu server fleet should treat this as an urgent patching priority given that confirmation, the wide kernel version range affected, and the Linux kernel's near-ubiquitous deployment footprint. The sole real constraint is the local attack vector: remote exploitation is not achievable without a prior foothold, which limits opportunistic mass exploitation but does not reduce risk in environments where remote-code-execution vulnerabilities or phishing are realistic entry points. |
| Exploit ScenarioDerived | An attacker with a local unprivileged shell on an Ubuntu 22.04 LTS server - where user namespaces are enabled by default - creates a user namespace to obtain CAP_NET_ADMIN, then uses nftables APIs to construct an nft table A containing a set, and a second table B with an object referencing A's set. The attacker deletes table A, freeing its memory, and then exercises the dangling reference from table B's object, triggering use-after-free corruption of kernel heap structures. With publicly available exploit code (referenced by ZDI advisory ZDI-22-1118), this sequence reliably results in local root escalation. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Aug 13, 2026
Use-after-free in the Linux kernel's nftables subsystem allows local privilege escalation to root when a cross-table object or expression references an nft set that is subsequently freed upon table deletion. Confirmed actively exploited (CISA KEV) with publicly available exploit code, this flaw affects Linux kernel versions up to and including 6.0, with explicit Ubuntu distribution coverage spanning 14.04 ESM through 22.04 LTS. On systems where unprivileged user namespaces are enabled by default - including Ubuntu LTS releases - any local user can obtain the necessary capability to trigger the vulnerability without elevated account permissions.
Earlier versions of this analysis (1)
It was discovered that a nft object or expression could reference a nft set on a different nft table, leading to a use-after-free once that table was deleted.
RemediationAI
The upstream fix is available as a patch submitted to the netfilter-devel kernel mailing list at https://lore.kernel.org/netfilter-devel/20220809170148.164591-1-cascardo@canonical.com/T/#t. Ubuntu users should apply the kernel updates documented in the applicable USN advisories - beginning with USN-5557-1 at https://ubuntu.com/security/notices/USN-5557-1 - for their respective release; exact patched kernel package versions per Ubuntu release should be obtained directly from those advisories, as specific version strings are not independently confirmed in available reference data. For systems where immediate patching is not possible, disabling unprivileged user namespaces via sysctl -w kernel.unprivileged_userns_clone=0 (or kernel.unprivileged_userns_clone=0 in /etc/sysctl.d/) eliminates the most accessible exploitation path, though this breaks sandboxed applications relying on namespace isolation such as Chromium, Firefox, and snap-based packages - evaluate workload impact before applying. Alternatively, deploying AppArmor or seccomp policies that restrict CAP_NET_ADMIN to authorized processes reduces exposure while preserving more functionality. Patching remains the only complete remediation.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
nftables is the Linux kernel's modern replacement for iptables, implemented within the kernel's netfilter framework and responsible for packet filtering, NAT, and stateful traffic inspection. The root cause (CWE-416, Use After Free) is a missing isolation enforcement between nft tables: an nft object or expression in one table is permitted to hold a reference to an nft set defined in a different table. When the table owning that set is deleted, the kernel frees the associated memory without invalidating the cross-table reference. The referencing object retains a dangling pointer into freed kernel heap memory. Subsequent kernel access to that pointer constitutes a use-after-free condition, enabling an attacker to corrupt kernel data structures and redirect execution to achieve arbitrary code execution in ring 0. CPE data confirms the affected component as cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* up to and including 6.0, alongside Ubuntu distributions from 14.04 ESM through 22.04 LTS. The patch was submitted to the netfilter-devel kernel mailing list by Thadeu Lima de Souza Cascardo of Canonical on August 9, 2022.
Know when Ubuntu Linux gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local attack vector with low privileges required; default user namespace support effectively lowers exploitation bar; full C/I/A impact via kernel heap corruption enabling root escalation.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
7DescriptionNVD
It was discovered that a nft object or expression could reference a nft set on a different nft table, leading to a use-after-free once that table was deleted.
Executive ViewAI
Ubuntu systems running versions 14.04 ESM through 22.04 LTS face an immediate privilege escalation risk from CVE-2022-2586, a kernel vulnerability allowing any local user to gain root access on systems with unprivileged user namespaces enabled. This flaw is confirmed actively exploited (CISA KEV) with public exploit code available, creating total system compromise risk for unprivileged accounts. Immediate kernel patching is critical to prevent unauthorized root-level access across Ubuntu deployments.
Patch available per vendor advisory. Interim mitigations if immediate patching is infeasible: disable unprivileged user namespaces via 'sysctl -w user.max_user_namespaces=0' where workload permits; restrict local user access through SSH configuration and PAM modules; implement kernel module restrictions to limit nftables subsystem accessibility.
Threat Intelligence Overview
NVD
CVE.org
CISA KEV
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Affected Products (CPE)NVD
More in Ubuntu Linux
View allOracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.
When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTT
Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe
Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and
Local privilege escalation in the GNU C Library (glibc) dynamic loader ld.so allows unprivileged local users on affected
GitHub PoC
Exploit-DB