GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2022-50780 (GCVE-0-2022-50780)

Vulnerability from cvelistv5 – Published: 2025-12-24 13:06 – Updated: 2026-08-05 08:59
VLAI
Title
net: fix UAF issue in nfqnl_nf_hook_drop() when ops_init() failed
Summary
In the Linux kernel, the following vulnerability has been resolved: net: fix UAF issue in nfqnl_nf_hook_drop() when ops_init() failed When the ops_init() interface is invoked to initialize the net, but ops->init() fails, data is released. However, the ptr pointer in net->gen is invalid. In this case, when nfqnl_nf_hook_drop() is invoked to release the net, invalid address access occurs. The process is as follows: setup_net() ops_init() data = kzalloc(...) ---> alloc "data" net_assign_generic() ---> assign "date" to ptr in net->gen ... ops->init() ---> failed ... kfree(data); ---> ptr in net->gen is invalid ... ops_exit_list() ... nfqnl_nf_hook_drop() *q = nfnl_queue_pernet(net) ---> q is invalid The following is the Call Trace information: BUG: KASAN: use-after-free in nfqnl_nf_hook_drop+0x264/0x280 Read of size 8 at addr ffff88810396b240 by task ip/15855 Call Trace: <TASK> dump_stack_lvl+0x8e/0xd1 print_report+0x155/0x454 kasan_report+0xba/0x1f0 nfqnl_nf_hook_drop+0x264/0x280 nf_queue_nf_hook_drop+0x8b/0x1b0 __nf_unregister_net_hook+0x1ae/0x5a0 nf_unregister_net_hooks+0xde/0x130 ops_exit_list+0xb0/0x170 setup_net+0x7ac/0xbd0 copy_net_ns+0x2e6/0x6b0 create_new_namespaces+0x382/0xa50 unshare_nsproxy_namespaces+0xa6/0x1c0 ksys_unshare+0x3a4/0x7e0 __x64_sys_unshare+0x2d/0x40 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 </TASK> Allocated by task 15855: kasan_save_stack+0x1e/0x40 kasan_set_track+0x21/0x30 __kasan_kmalloc+0xa1/0xb0 __kmalloc+0x49/0xb0 ops_init+0xe7/0x410 setup_net+0x5aa/0xbd0 copy_net_ns+0x2e6/0x6b0 create_new_namespaces+0x382/0xa50 unshare_nsproxy_namespaces+0xa6/0x1c0 ksys_unshare+0x3a4/0x7e0 __x64_sys_unshare+0x2d/0x40 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 Freed by task 15855: kasan_save_stack+0x1e/0x40 kasan_set_track+0x21/0x30 kasan_save_free_info+0x2a/0x40 ____kasan_slab_free+0x155/0x1b0 slab_free_freelist_hook+0x11b/0x220 __kmem_cache_free+0xa4/0x360 ops_init+0xb9/0x410 setup_net+0x5aa/0xbd0 copy_net_ns+0x2e6/0x6b0 create_new_namespaces+0x382/0xa50 unshare_nsproxy_namespaces+0xa6/0x1c0 ksys_unshare+0x3a4/0x7e0 __x64_sys_unshare+0x2d/0x40 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: f875bae065334907796da12523f9df85c89f5712 , < 5a2ea549be94924364f6911227d99be86e8cf34a (git)
Affected: f875bae065334907796da12523f9df85c89f5712 , < 97ad240fd9aa9214497d14af2b91608e20856cac (git)
Affected: f875bae065334907796da12523f9df85c89f5712 , < c3edc6e808209aa705185f732e682a370981ced1 (git)
Affected: f875bae065334907796da12523f9df85c89f5712 , < a1e18acb0246bfb001b08b8b1b830b5ec92a0f13 (git)
Affected: f875bae065334907796da12523f9df85c89f5712 , < 4a4df5e78712de39d6f90d6a64b5eb48dca03bd5 (git)
Affected: f875bae065334907796da12523f9df85c89f5712 , < d266935ac43d57586e311a087510fe6a084af742 (git)
guessed Create a notification for this product.
Linux Linux Affected: 2.6.33
Unaffected: 0 , < 2.6.33 (semver)
Unaffected: 4.19.264 , ≤ 4.19.* (semver)
Unaffected: 5.4.223 , ≤ 5.4.* (semver)
Unaffected: 5.10.153 , ≤ 5.10.* (semver)
Unaffected: 5.15.77 , ≤ 5.15.* (semver)
Unaffected: 6.0.7 , ≤ 6.0.* (semver)
Unaffected: 6.1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/core/net_namespace.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5a2ea549be94924364f6911227d99be86e8cf34a",
              "status": "affected",
              "version": "f875bae065334907796da12523f9df85c89f5712",
              "versionType": "git"
            },
            {
              "lessThan": "97ad240fd9aa9214497d14af2b91608e20856cac",
              "status": "affected",
              "version": "f875bae065334907796da12523f9df85c89f5712",
              "versionType": "git"
            },
            {
              "lessThan": "c3edc6e808209aa705185f732e682a370981ced1",
              "status": "affected",
              "version": "f875bae065334907796da12523f9df85c89f5712",
              "versionType": "git"
            },
            {
              "lessThan": "a1e18acb0246bfb001b08b8b1b830b5ec92a0f13",
              "status": "affected",
              "version": "f875bae065334907796da12523f9df85c89f5712",
              "versionType": "git"
            },
            {
              "lessThan": "4a4df5e78712de39d6f90d6a64b5eb48dca03bd5",
              "status": "affected",
              "version": "f875bae065334907796da12523f9df85c89f5712",
              "versionType": "git"
            },
            {
              "lessThan": "d266935ac43d57586e311a087510fe6a084af742",
              "status": "affected",
              "version": "f875bae065334907796da12523f9df85c89f5712",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/core/net_namespace.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.33"
            },
            {
              "lessThan": "2.6.33",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.264",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.223",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.153",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.77",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.0.*",
              "status": "unaffected",
              "version": "6.0.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.264",
                  "versionStartIncluding": "2.6.33",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.223",
                  "versionStartIncluding": "2.6.33",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.153",
                  "versionStartIncluding": "2.6.33",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.77",
                  "versionStartIncluding": "2.6.33",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0.7",
                  "versionStartIncluding": "2.6.33",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1",
                  "versionStartIncluding": "2.6.33",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: fix UAF issue in nfqnl_nf_hook_drop() when ops_init() failed\n\nWhen the ops_init() interface is invoked to initialize the net, but\nops-\u003einit() fails, data is released. However, the ptr pointer in\nnet-\u003egen is invalid. In this case, when nfqnl_nf_hook_drop() is invoked\nto release the net, invalid address access occurs.\n\nThe process is as follows:\nsetup_net()\n\tops_init()\n\t\tdata = kzalloc(...)   ---\u003e alloc \"data\"\n\t\tnet_assign_generic()  ---\u003e assign \"date\" to ptr in net-\u003egen\n\t\t...\n\t\tops-\u003einit()           ---\u003e failed\n\t\t...\n\t\tkfree(data);          ---\u003e ptr in net-\u003egen is invalid\n\t...\n\tops_exit_list()\n\t\t...\n\t\tnfqnl_nf_hook_drop()\n\t\t\t*q = nfnl_queue_pernet(net) ---\u003e q is invalid\n\nThe following is the Call Trace information:\nBUG: KASAN: use-after-free in nfqnl_nf_hook_drop+0x264/0x280\nRead of size 8 at addr ffff88810396b240 by task ip/15855\nCall Trace:\n\u003cTASK\u003e\ndump_stack_lvl+0x8e/0xd1\nprint_report+0x155/0x454\nkasan_report+0xba/0x1f0\nnfqnl_nf_hook_drop+0x264/0x280\nnf_queue_nf_hook_drop+0x8b/0x1b0\n__nf_unregister_net_hook+0x1ae/0x5a0\nnf_unregister_net_hooks+0xde/0x130\nops_exit_list+0xb0/0x170\nsetup_net+0x7ac/0xbd0\ncopy_net_ns+0x2e6/0x6b0\ncreate_new_namespaces+0x382/0xa50\nunshare_nsproxy_namespaces+0xa6/0x1c0\nksys_unshare+0x3a4/0x7e0\n__x64_sys_unshare+0x2d/0x40\ndo_syscall_64+0x35/0x80\nentry_SYSCALL_64_after_hwframe+0x46/0xb0\n\u003c/TASK\u003e\n\nAllocated by task 15855:\nkasan_save_stack+0x1e/0x40\nkasan_set_track+0x21/0x30\n__kasan_kmalloc+0xa1/0xb0\n__kmalloc+0x49/0xb0\nops_init+0xe7/0x410\nsetup_net+0x5aa/0xbd0\ncopy_net_ns+0x2e6/0x6b0\ncreate_new_namespaces+0x382/0xa50\nunshare_nsproxy_namespaces+0xa6/0x1c0\nksys_unshare+0x3a4/0x7e0\n__x64_sys_unshare+0x2d/0x40\ndo_syscall_64+0x35/0x80\nentry_SYSCALL_64_after_hwframe+0x46/0xb0\n\nFreed by task 15855:\nkasan_save_stack+0x1e/0x40\nkasan_set_track+0x21/0x30\nkasan_save_free_info+0x2a/0x40\n____kasan_slab_free+0x155/0x1b0\nslab_free_freelist_hook+0x11b/0x220\n__kmem_cache_free+0xa4/0x360\nops_init+0xb9/0x410\nsetup_net+0x5aa/0xbd0\ncopy_net_ns+0x2e6/0x6b0\ncreate_new_namespaces+0x382/0xa50\nunshare_nsproxy_namespaces+0xa6/0x1c0\nksys_unshare+0x3a4/0x7e0\n__x64_sys_unshare+0x2d/0x40\ndo_syscall_64+0x35/0x80\nentry_SYSCALL_64_after_hwframe+0x46/0xb0"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached via the local unshare/clone CLONE_NEWNET path (ksys_unshare \u2192 copy_net_ns \u2192 setup_net \u2192 ops_init), not by processing remote packets or an adjacent-network protocol.\nAC:L - An attacker who can create network namespaces can induce the ops-\u003einit() failure (e.g., memory pressure so nfnl_queue_net_init\u0027s proc_create_net fails after allocation) and spray the freed object during the synchronize_rcu() window before nfqnl_nf_hook_drop runs; no conditions outside attacker influence are required.\nPR:L - Creating a netns requires CAP_SYS_ADMIN only in the associated user namespace, which an unprivileged user obtains via CLONE_NEWUSER (unshare -Urn); real init-namespace root is not required.\nUI:N - The attacker triggers the vulnerability directly with their own unshare/netns creation; no separate victim action is needed.\nS:U - Impact is confined to the local kernel\u0027s memory/authority (UAF in netns/netfilter teardown); this is not a VM escape, IOMMU bypass, or other cross-boundary break.\nC:H - This is a use-after-free of the nfnl_queue_net object with an RCU grace-period window for heap reuse, enabling disclosure of reclaimed object contents per UAF scoring guidance.\nI:H - The same UAF is reachable while nfqnl_nf_hook_drop walks instance_table and calls nfqnl_flush on entries, so heap spray of fake queue/instance state can yield corruption and control-flow hijack primitives.\nA:H - Dereferencing the dangling nfnl_queue_pernet() pointer causes a kernel KASAN/UAF oops or panic, which is high availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:59:45.573Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5a2ea549be94924364f6911227d99be86e8cf34a"
        },
        {
          "url": "https://git.kernel.org/stable/c/97ad240fd9aa9214497d14af2b91608e20856cac"
        },
        {
          "url": "https://git.kernel.org/stable/c/c3edc6e808209aa705185f732e682a370981ced1"
        },
        {
          "url": "https://git.kernel.org/stable/c/a1e18acb0246bfb001b08b8b1b830b5ec92a0f13"
        },
        {
          "url": "https://git.kernel.org/stable/c/4a4df5e78712de39d6f90d6a64b5eb48dca03bd5"
        },
        {
          "url": "https://git.kernel.org/stable/c/d266935ac43d57586e311a087510fe6a084af742"
        }
      ],
      "title": "net: fix UAF issue in nfqnl_nf_hook_drop() when ops_init() failed",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-50780",
    "datePublished": "2025-12-24T13:06:08.552Z",
    "dateReserved": "2025-12-24T13:02:21.548Z",
    "dateUpdated": "2026-08-05T08:59:45.573Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-50780",
      "date": "2026-09-17",
      "epss": "0.00156",
      "percentile": "0.05219"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-50780\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-12-24T13:16:04.843\",\"lastModified\":\"2026-08-04T10:18:24.063\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet: fix UAF issue in nfqnl_nf_hook_drop() when ops_init() failed\\n\\nWhen the ops_init() interface is invoked to initialize the net, but\\nops-\u003einit() fails, data is released. However, the ptr pointer in\\nnet-\u003egen is invalid. In this case, when nfqnl_nf_hook_drop() is invoked\\nto release the net, invalid address access occurs.\\n\\nThe process is as follows:\\nsetup_net()\\n\\tops_init()\\n\\t\\tdata = kzalloc(...)   ---\u003e alloc \\\"data\\\"\\n\\t\\tnet_assign_generic()  ---\u003e assign \\\"date\\\" to ptr in net-\u003egen\\n\\t\\t...\\n\\t\\tops-\u003einit()           ---\u003e failed\\n\\t\\t...\\n\\t\\tkfree(data);          ---\u003e ptr in net-\u003egen is invalid\\n\\t...\\n\\tops_exit_list()\\n\\t\\t...\\n\\t\\tnfqnl_nf_hook_drop()\\n\\t\\t\\t*q = nfnl_queue_pernet(net) ---\u003e q is invalid\\n\\nThe following is the Call Trace information:\\nBUG: KASAN: use-after-free in nfqnl_nf_hook_drop+0x264/0x280\\nRead of size 8 at addr ffff88810396b240 by task ip/15855\\nCall Trace:\\n\u003cTASK\u003e\\ndump_stack_lvl+0x8e/0xd1\\nprint_report+0x155/0x454\\nkasan_report+0xba/0x1f0\\nnfqnl_nf_hook_drop+0x264/0x280\\nnf_queue_nf_hook_drop+0x8b/0x1b0\\n__nf_unregister_net_hook+0x1ae/0x5a0\\nnf_unregister_net_hooks+0xde/0x130\\nops_exit_list+0xb0/0x170\\nsetup_net+0x7ac/0xbd0\\ncopy_net_ns+0x2e6/0x6b0\\ncreate_new_namespaces+0x382/0xa50\\nunshare_nsproxy_namespaces+0xa6/0x1c0\\nksys_unshare+0x3a4/0x7e0\\n__x64_sys_unshare+0x2d/0x40\\ndo_syscall_64+0x35/0x80\\nentry_SYSCALL_64_after_hwframe+0x46/0xb0\\n\u003c/TASK\u003e\\n\\nAllocated by task 15855:\\nkasan_save_stack+0x1e/0x40\\nkasan_set_track+0x21/0x30\\n__kasan_kmalloc+0xa1/0xb0\\n__kmalloc+0x49/0xb0\\nops_init+0xe7/0x410\\nsetup_net+0x5aa/0xbd0\\ncopy_net_ns+0x2e6/0x6b0\\ncreate_new_namespaces+0x382/0xa50\\nunshare_nsproxy_namespaces+0xa6/0x1c0\\nksys_unshare+0x3a4/0x7e0\\n__x64_sys_unshare+0x2d/0x40\\ndo_syscall_64+0x35/0x80\\nentry_SYSCALL_64_after_hwframe+0x46/0xb0\\n\\nFreed by task 15855:\\nkasan_save_stack+0x1e/0x40\\nkasan_set_track+0x21/0x30\\nkasan_save_free_info+0x2a/0x40\\n____kasan_slab_free+0x155/0x1b0\\nslab_free_freelist_hook+0x11b/0x220\\n__kmem_cache_free+0xa4/0x360\\nops_init+0xb9/0x410\\nsetup_net+0x5aa/0xbd0\\ncopy_net_ns+0x2e6/0x6b0\\ncreate_new_namespaces+0x382/0xa50\\nunshare_nsproxy_namespaces+0xa6/0x1c0\\nksys_unshare+0x3a4/0x7e0\\n__x64_sys_unshare+0x2d/0x40\\ndo_syscall_64+0x35/0x80\\nentry_SYSCALL_64_after_hwframe+0x46/0xb0\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/core/net_namespace.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"f875bae065334907796da12523f9df85c89f5712\",\"lessThan\":\"5a2ea549be94924364f6911227d99be86e8cf34a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f875bae065334907796da12523f9df85c89f5712\",\"lessThan\":\"97ad240fd9aa9214497d14af2b91608e20856cac\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f875bae065334907796da12523f9df85c89f5712\",\"lessThan\":\"c3edc6e808209aa705185f732e682a370981ced1\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f875bae065334907796da12523f9df85c89f5712\",\"lessThan\":\"a1e18acb0246bfb001b08b8b1b830b5ec92a0f13\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f875bae065334907796da12523f9df85c89f5712\",\"lessThan\":\"4a4df5e78712de39d6f90d6a64b5eb48dca03bd5\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f875bae065334907796da12523f9df85c89f5712\",\"lessThan\":\"d266935ac43d57586e311a087510fe6a084af742\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/core/net_namespace.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2.6.33\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"2.6.33\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"4.19.264\",\"lessThanOrEqual\":\"4.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.223\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.153\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.77\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.0.7\",\"lessThanOrEqual\":\"6.0.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/4a4df5e78712de39d6f90d6a64b5eb48dca03bd5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/5a2ea549be94924364f6911227d99be86e8cf34a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/97ad240fd9aa9214497d14af2b91608e20856cac\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/a1e18acb0246bfb001b08b8b1b830b5ec92a0f13\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/c3edc6e808209aa705185f732e682a370981ced1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/d266935ac43d57586e311a087510fe6a084af742\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T19:36:26+00:00",
      "cve": "CVE-2022-50780",
      "id": "CVE-2022-50780",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:fixed": "279",
      "product_status:known_affected": "112",
      "product_status:known_not_affected": "76",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net: fix UAF issue in nfqnl_nf_hook_drop() when ops_init() failed",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-50780.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-03T00:36:37Z",
      "cve": "CVE-2022-50780",
      "id": "CVE-2022-50780",
      "initial_release_date": "2025-12-25T01:03:30Z",
      "product_status:known_affected": "394",
      "product_status:known_not_affected": "492",
      "product_status:recommended": "66",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2022-50780",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2022-50780.json",
      "version": "16"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.