CVE-2022-4744

HIGH

Linux Kernel < 5.10.136 - Double Free

Title source: rule

Description

A double-free flaw was found in the Linux kernel’s TUN/TAP device driver functionality in how a user registers the device when the register_netdevice function fails (NETDEV_REGISTER notifier). This flaw allows a local user to crash or potentially escalate their privileges on the system.

References (4)

[Third Party Advisory, VDB Entry] http://packetstormsecurity.com/files/171912/CentOS-Stream-9-Missing-Kernel-Security-Fix.html

[Vendor Advisory] https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=158b515f703e

[Mailing List, Third Party Advisory] https://lists.debian.org/debian-lts-announce/2023/05/msg00006.html

[Third Party Advisory] https://security.netapp.com/advisory/ntap-20230526-0009/

Scores

CVSS v3 7.8

EPSS 0.0008

EPSS Percentile 24.6%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Classification

CWE

CWE-415 CWE-460

Status published

Affected Products (1)

linux/linux_kernel < 5.10.136

Timeline

Published Mar 30, 2023

Tracked Since Feb 18, 2026