CVE-2022-2586

MEDIUM KEV

Linux Kernel < 5.19.17 - Use-After-Free via NFT Object or Expression Reference

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2022-2586 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added June 26, 2024. EIP tracks 3 public exploits from researchers including aels, sniper404ghostxploit.

AI-analyzed exploit summary This is a local privilege escalation (LPE) exploit for CVE-2022-2586, targeting a use-after-free (UAF) vulnerability in the Linux kernel's nft_object. The exploit leverages nftables operations to achieve arbitrary memory manipulation and ultimately gain root privileges.

Description

It was discovered that a nft object or expression could reference a nft set on a different nft table, leading to a use-after-free once that table was deleted.

Exploits (3)

nomisec WORKING POC 20 stars
by aels · local
https://github.com/aels/CVE-2022-2586-LPE

This is a local privilege escalation (LPE) exploit for CVE-2022-2586, targeting a use-after-free (UAF) vulnerability in the Linux kernel's nft_object. The exploit leverages nftables operations to achieve arbitrary memory manipulation and ultimately gain root privileges.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Complex
Reliability
Racy
Target: Linux kernel (specific versions affected by CVE-2022-2586)
No auth needed
Prerequisites: Local access to the vulnerable system · Kernel version affected by CVE-2022-2586 · Appropriate kernel configuration (e.g., nftables enabled)
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC 3 stars
by sniper404ghostxploit · local
https://github.com/sniper404ghostxploit/CVE-2022-2586

This is a local privilege escalation (LPE) exploit for CVE-2022-2586, targeting a use-after-free (UAF) vulnerability in the Linux kernel's nft_object. It leverages memory corruption to achieve arbitrary code execution in kernel context, ultimately gaining root privileges.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Complex
Reliability
Racy
Target: Linux kernel (specific versions affected by CVE-2022-2586)
No auth needed
Prerequisites: Local access to the vulnerable system · Kernel version affected by CVE-2022-2586 · Compilation with specific libraries (libmnl, libnftnl)
devstral-2 · analyzed Feb 16, 2026 Full analysis →
vulncheck_xdb WORKING POC
local
https://github.com/greek0x0/2022-LPE-UAF

This repository contains functional exploit code for CVE-2022-2586, a use-after-free (UAF) vulnerability in the Linux kernel's nf_tables subsystem. The PoC demonstrates the vulnerability by creating and manipulating nf_tables objects and sets to trigger the UAF condition, potentially leading to local privilege escalation (LPE).

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: Linux kernel (nf_tables subsystem)
No auth needed
Prerequisites: Linux kernel with nf_tables support · Local user access
devstral-2 · analyzed Feb 25, 2026 Full analysis →

References (15)

Core 15
Core References
Third Party Advisory third-party-advisory
https://ubuntu.com/security/notices/USN-5564-1
Third Party Advisory third-party-advisory
https://ubuntu.com/security/notices/USN-5560-2
Third Party Advisory third-party-advisory
https://ubuntu.com/security/notices/USN-5582-1
Third Party Advisory third-party-advisory
https://ubuntu.com/security/notices/USN-5567-1
Third Party Advisory third-party-advisory
https://ubuntu.com/security/notices/USN-5560-1
Third Party Advisory third-party-advisory
https://ubuntu.com/security/notices/USN-5566-1
Third Party Advisory third-party-advisory
https://ubuntu.com/security/notices/USN-5565-1
Third Party Advisory, VDB Entry issue-tracking
https://www.zerodayinitiative.com/advisories/ZDI-22-1118/
Third Party Advisory third-party-advisory
https://ubuntu.com/security/notices/USN-5562-1
Third Party Advisory third-party-advisory
https://ubuntu.com/security/notices/USN-5557-1

Scores

CVSS v3 5.3
EPSS 0.0275
EPSS Percentile 86.4%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H

CISA SSVC

Vulnrichment
Exploitation active
Automatable no
Technical Impact total

Details

CISA KEV 2024-06-26
VulnCheck KEV 2024-06-19
InTheWild.io 2024-06-22
ENISA EUVD EUVD-2022-34835
CWE
CWE-416
Status published
Products (7)
canonical/ubuntu_linux 14.04
canonical/ubuntu_linux 16.04
canonical/ubuntu_linux 18.04
canonical/ubuntu_linux 20.04
canonical/ubuntu_linux 22.04
linux/linux_kernel 6.0
linux/linux_kernel < 5.19.17
Published Jan 08, 2024
KEV Added Jun 26, 2024
Tracked Since Feb 18, 2026