LiveActive security incident?Get immediate response
CVE Record

CVE-2022-50212: netfilter: nf_tables: do not allow CHAIN_ID to refer to another table

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: do not allow CHAIN_ID to refer to another table When doing lookups for chains on the same batch by using its ID, a chain from a different table can be used. If a rule is added to a table but refers to a chain in a different table, it will be linked to the chain in table2, but would have expressions referring to objects in table1. Then, when table1 is removed, the rule will not be removed as its linked to a chain in table2. When expressions in the rule are processed or removed, that will lead to a use-after-free. When looking for chains by ID, use the table that was used for the lookup by name, and only return chains belonging to that same table.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2022-50212 is a Linux kernel netfilter nf_tables flaw. A crafted ruleset batch could link a rule across tables incorrectly, leaving stale references after one table is removed. That can cause a use-after-free in kernel code. Public sources provided do not state confirmed exploitation, CVSS severity, or business impact.

Executive priority

Treat as a kernel hygiene and exposure-management item, not a confirmed emergency from the supplied evidence. Prioritize patch verification on shared Linux infrastructure and systems where untrusted users or workloads may interact with firewalling features.

Technical view

The bug is in nf_tables chain lookup by CHAIN_ID during same-batch operations. A chain from another table could be returned, causing a rule in one table to link to a chain in another table while expressions reference objects from the first table. Removing the first table can leave freed expressions reachable, triggering use-after-free processing or cleanup.

Likely exposure

Exposure is likely limited to Linux systems running affected kernel versions with nf_tables available. The bundle lists Linux 5.9 and stable-series markers 5.10.137, 5.15.61, 5.18.18, 5.19.2, and 6.0, but exact affected ranges should be confirmed against vendor kernel packages.

Exploitation context

The provided sources do not show CISA KEV listing or active exploitation. They describe a kernel use-after-free condition reachable through nf_tables rule/table operations. The bundle does not state whether local privileges, namespace access, or specific capabilities are required.

Researcher notes

Evidence supports a fixed nf_tables use-after-free caused by cross-table CHAIN_ID lookup. The sources do not provide CVSS, CWE, exploit prerequisites, or confirmed exploit activity. Avoid assuming privilege escalation without vendor or researcher confirmation.

Mitigation direction

  • Review vendor kernel advisories for your distribution or appliance platform.
  • Upgrade to kernel packages containing the referenced stable fixes.
  • Prioritize internet-facing hosts, container platforms, and shared Linux infrastructure.
  • Restrict untrusted ability to manipulate nftables where operationally possible.
  • Track unsupported kernels for replacement or isolation decisions.

Validation and detection

  • Inventory Linux kernel versions across servers, containers hosts, and appliances.
  • Confirm whether nf_tables is present and used on each system.
  • Map installed kernels to distribution advisories for CVE-2022-50212.
  • Verify patched builds include one of the referenced stable commits.
  • Document exceptions where vendor status is unavailable or unsupported.
Prepared
Confidence
medium
Sources
7

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2022-50212 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
6Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux837830a4b439bfeb86c70b0115c280377c84714b, 837830a4b439bfeb86c70b0115c280377c84714b, 837830a4b439bfeb86c70b0115c280377c84714b, 837830a4b439bfeb86c70b0115c280377c84714b, 837830a4b439bfeb86c70b0115c280377c84714bunaffected
LinuxLinux5.9, 0, 5.10.137, 5.15.61, 5.18.18, 5.19.2, 6.0affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.