Linux Kernel
CVE-2022-2588
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain local/unprivileged shell or container
-
DeliveryGain CAP_NET_ADMIN via user/network namespace
-
ExploitAdd cls_route filter with handle 0
-
ExecutionTrigger stale filter free (use-after-free)
-
PersistGroom and corrupt freed kernel object
-
ImpactExecute code in kernel as root
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires local access to the host and the ability to create and configure a cls_route (route4) traffic-control classifier - effectively CAP_NET_ADMIN, which an unprivileged user can obtain within a network namespace on distributions that permit unprivileged user namespaces (a common container/desktop default). The specific trigger is adding a cls_route filter whose handle has the value 0, so the stale filter is not unlinked from the hashtable before being freed. Limiting factors: exploitation is local-only (not remotely reachable), depends on the kernel being built with the cls_route/CONFIG_NET_CLS_ROUTE4 classifier available, and depends on the deployment allowing unprivileged users to acquire network-namespace capabilities; hardened systems that disable unprivileged user namespaces or blacklist the module significantly raise the bar. |
| Impact | This is a genuine high-priority local privilege escalation flaw, not a high-CVSS paper risk. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) describes a local, low-complexity attack by an already-authenticated low-privileged user yielding full confidentiality, integrity and availability loss - the classic signature of a use-after-free (CWE-416) exploited for kernel code execution and root escalation. Corroborating signals are strong: a public exploit exists (GitHub Markakd/CVE-2022-2588 and ZDI-22-1117), the patch is confirmed via the netdev kernel mailing list and numerous Ubuntu USNs, and the EPSS score of 59.36% (98th percentile) is unusually high, reflecting the public, reliable exploit. The main tension to flag is that EPSS measures the probability of ANY observed exploitation activity, which for a local-only kernel bug (AV:L) does not translate into remote mass exploitation - this requires an attacker to already have a foothold on the host. The vulnerability is NOT listed in CISA KEV in the provided data, so despite the high EPSS and public POC there is no confirmation of active in-the-wild exploitation. Net: treat as a priority patch for multi-user, container, and shared Linux hosts where local code execution by low-trust users is possible. |
| Exploit ScenarioDerived | A local low-privileged user (or code running inside a container with the ability to create network namespaces) configures a cls_route traffic-control filter with a handle value of 0, triggering the use-after-free when the stale filter is freed without being removed from the hashtable. A publicly available exploit (Markakd/CVE-2022-2588, also detailed in ZDI-22-1117) then grooms the freed kernel object to corrupt memory and escalate to root. Because AV:L/AC:L applies, exploitation is reliable and low-complexity once local execution is obtained. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Oct 14, 2026
Local privilege escalation in the Linux kernel traffic-control subsystem allows an attacker who can create a cls_route (route4) filter to corrupt kernel memory via a use-after-free. When such a filter is added with a handle value of 0, the kernel fails to unlink the previous filter from the hashtable before freeing it, leaving a dangling reference that can be reallocated and manipulated to achieve code execution or information disclosure with kernel privileges. Exploitation is local-only and requires the ability to configure tc/netlink classifiers (effectively CAP_NET_ADMIN, reachable by unprivileged users through user namespaces on many default configurations), but publicly available exploit code exists (Markakd/CVE-2022-2588) and the EPSS score is very high at 59.36% (98th percentile), making this a genuine high-priority local privilege escalation flaw rather than a paper risk. Vendor patches are available via Ubuntu security notices and the upstream netdev fix; CISA KEV does not list it as confirmed actively exploited.
Earlier versions of this analysis (1)
It was discovered that the cls_route filter implementation in the Linux kernel would not remove an old filter from the hashtable before freeing it if its handle had the value 0.
RemediationAI
Apply the vendor-released kernel updates for your distribution; Ubuntu users should install the kernels from USN-5557-1, USN-5560-1/2, USN-5562-1, USN-5564-1, USN-5565-1, USN-5566-1, USN-5567-1, USN-5582-1 and USN-5588-1, and the upstream fix is referenced at https://lore.kernel.org/netdev/20220809170518.164662-1-cascardo@canonical.com/T/#u (patch available from vendor). Where patching must be deferred, the most effective compensating control is to prevent unprivileged users from obtaining network-namespace capabilities: set kernel.unprivileged_userns_clone=0 (Debian/Ubuntu) or user.max_user_namespaces=0, which blocks the common route to CAP_NET_ADMIN inside a namespace - the trade-off is that this breaks unprivileged container runtimes, sandboxed browsers and some desktop features. Additionally blacklist or do not load the route4 classifier (modprobe.blacklist / remove cls_route support, or build without CONFIG_NET_CLS_ROUTE4), understanding that this disables legitimate tc route-based traffic shaping. Restricting who can invoke tc and netlink qdisc/filter operations via existing CAP_NET_ADMIN separation, and running untrusted workloads outside host namespaces, further reduces exposure. Note that exploit code is publicly available, so these mitigations should be treated as temporary until the kernel package is updated and the host rebooted.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a use-after-free (CWE-416) in the Linux kernel's cls_route classifier, the component backing the route4 traffic-control filter used by the tc/netlink packet-scheduling framework (CONFIG_NET_CLS_ROUTE4). The classifier maintains a hashtable of filters keyed by handle; when a replacement filter is installed, the kernel is expected to unlink the stale entry before freeing its memory. The vulnerable code path omits that unlink when the new filter's handle is 0, so a freed filter object remains reachable from the hashtable. Because the object is freed but still referenced, a local attacker can trigger reallocation of the slab slot with attacker-controlled data and influence kernel execution. The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H confirms a low-complexity local attack requiring low privileges (an authenticated local user), yielding high confidentiality, integrity and availability impact confined to the same security scope. CPE data scopes the affected component to linux:linux_kernel across multiple version ranges, with Canonical:ubuntu_linux 14.04 ESM and 16.04 ESM also enumerated.
Know when Ubuntu Linux gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local-only kernel UAF (AV:L) triggered reliably by a low-privileged user able to configure tc filters (PR:L, AC:L), yielding kernel code execution with full C/I/A impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
6DescriptionNVD
It was discovered that the cls_route filter implementation in the Linux kernel would not remove an old filter from the hashtable before freeing it if its handle had the value 0.
Executive ViewAI
A high-severity local privilege escalation flaw in the Linux kernel's traffic-control subsystem can allow an attacker with local access and privileges to configure tc/netlink classifiers to achieve code execution or information disclosure with kernel privileges. Publicly available exploit code exists, and the EPSS score of 59.4% (98th percentile) indicates a high likelihood of exploitation, putting unpatched Linux servers, cloud instances, containers, and workstations at risk. Leadership should prioritize patching because this flaw affects widely deployed Linux infrastructure and can undermine the security of critical systems.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Affected Products (CPE)NVD
More in Ubuntu Linux
View allOracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.
When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTT
Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe
Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and
Local privilege escalation in the GNU C Library (glibc) dynamic loader ld.so allows unprivileged local users on affected
Exploit-DB