CVE-2022-50212: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50212 is a use-after-free vulnerability in the Linux kernel's netfilter nf_tables subsystem, caused by improper cross-table chain ID lookups. When a rule is added to one table but references a chain in a different table via CHAIN_ID, removing the first table does not remove the rule (since it is linked to the second table's chain), leading to a use-after-free when the rule's expressions are later processed or removed. The vulnerability affects Linux kernel versions 5.9.x before 5.10.137, 5.11.x through 5.15.x before 5.15.61, 5.16.x through 5.18.x before 5.18.18, and 5.19.x before 5.19.2. It carries a CVSS v3.1 base score of 7.8 (High) (Feedly).

The root cause is a use-after-free (CWE-416) in the nf_tables component of the Linux kernel's netfilter framework. During batch processing, when chains are looked up by ID, the kernel failed to enforce that the resolved chain belonged to the same table as the one used for the name-based lookup. This allowed a rule to be associated with a chain in table2 while its expressions referenced objects in table1. When table1 is subsequently deleted, the rule persists (anchored to table2's chain), and any subsequent access to the rule's expressions operates on freed memory. The fix restricts chain-by-ID lookups to only return chains belonging to the same table used in the original lookup (Feedly, Kernel Patch).

Successful exploitation allows a local attacker with low privileges to trigger a use-after-free condition in kernel memory, potentially leading to arbitrary code execution in kernel context, privilege escalation to root, or system crashes causing denial of service. All three security dimensions — confidentiality, integrity, and availability — are rated High, meaning an attacker could read sensitive kernel memory, corrupt kernel data structures, or crash the system (Feedly).

The vulnerability requires only local access and low privileges (no user interaction needed), making it accessible to any unprivileged local user or container escape scenario. The EPSS score is approximately 0.018% (0.000180), indicating a currently low probability of widespread exploitation. No public proof-of-concept exploit code, active in-the-wild exploitation, or CISA KEV catalog listing has been identified for this CVE. Qualys scanners have detection coverage for this vulnerability (detection IDs 759028 and 760415) (Feedly).

Apply the upstream kernel patches that restrict nf_tables chain-by-ID lookups to the originating table. Fixed versions include Linux kernel 5.10.137, 5.15.61, 5.18.18, and 5.19.2. Patches are available via the stable kernel tree at multiple commits (e.g., 0f49613a, 58e863f6, 91501513, 95f466d2, 9e7dcb88). Distributions such as SUSE have issued advisories (SUSE-2025-02308-1) incorporating these fixes; users should apply the latest vendor-provided kernel updates promptly (Feedly, SUSE Advisory).

SUSE issued a kernel security advisory (SUSE-2025-02308-1) rated "Important" that includes the fix for CVE-2022-50212 among other netfilter-related issues. No notable independent researcher commentary or significant social media discussion has been identified for this specific CVE (SUSE Advisory).