CVE-2022-50213: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50213 is a use-after-free vulnerability in the Linux kernel's netfilter nf_tables subsystem. It arises when a SET_ID lookup during batch processing is permitted to reference a set belonging to a different table; when that table is subsequently removed, a dangling reference to the freed set remains, creating a use-after-free condition. The vulnerability affects Linux kernel versions from 3.16 up to (but not including) the following fixed releases: 4.19.256, 5.4.211, 5.10.137, 5.15.61, 5.18.18, and 5.19.2. It was published on June 18, 2025, and carries a CVSS v3.1 base score of 7.8 (High) (Feedly). This CVE is noted as fixing the same underlying issue as CVE-2022-2586 (also reported as ZDI-CAN-17470) (Feedly).

The root cause is a use-after-free (CWE-416) in the nf_tables component of the Linux kernel's netfilter framework. When processing a batch of netlink operations, the kernel allows a SET_ID-based lookup to resolve a set from a different table than the one being operated on. If the owning table is subsequently deleted within the same batch, the set is freed while a reference to it is still held, leading to a use-after-free condition. The fix enforces that SET_ID lookups are scoped to the same table used for the name-based lookup, ensuring cross-table references are rejected (Feedly, Kernel Patch). Exploitation requires local access with low privileges (e.g., the ability to send netlink messages to the netfilter subsystem, typically available to unprivileged users with CAP_NET_ADMIN in a user namespace).

Successful exploitation of this vulnerability can result in high confidentiality, integrity, and availability impact on the affected system. An attacker with local access could leverage the use-after-free condition to achieve arbitrary kernel code execution, potentially enabling full privilege escalation to root. This could allow complete system compromise, unauthorized access to sensitive kernel memory, and denial of service through kernel crashes (Feedly).

CVE-2022-50213 is closely related to CVE-2022-2586 (ZDI-CAN-17470), for which public exploit research and proof-of-concept code have been developed in the security community. The EPSS score is 0.024% (0.000240), indicating a currently low probability of widespread exploitation. No CISA KEV catalog listing was identified for this specific CVE identifier. Exploitation requires local access with low privileges, limiting the attack surface compared to remote vulnerabilities (Feedly).

1. Gain local access: Obtain a low-privileged local shell on a vulnerable Linux system (kernel versions 3.16–5.19.1 without the patch applied).
2. Create a user namespace: Use unshare -Urn or similar to obtain CAP_NET_ADMIN within a user namespace, enabling netfilter/nftables operations without full root privileges.
3. Craft a malicious nftables batch: Using the nft tool or raw netlink messages, create two tables (e.g., table_A and table_B), add a set to table_A, then in a single batch operation reference that set by its ID while operating in the context of table_B.
4. Trigger table deletion: Within the same batch, delete table_A, causing the set to be freed while table_B's operation still holds a reference to it.
5. Exploit the use-after-free: Manipulate kernel heap memory to reclaim the freed set structure with attacker-controlled data, then trigger the dangling reference to achieve arbitrary kernel read/write or code execution, ultimately escalating privileges to root (Feedly).

• Logs: Kernel logs (dmesg / /var/log/kern.log) showing KASAN (Kernel Address Sanitizer) reports referencing nf_tables or nft_set, or general-protection fault / use-after-free messages in the netfilter subsystem.
• Process: Unexpected privilege escalation events — processes transitioning from unprivileged UIDs to UID 0 without a legitimate sudo/su invocation.
• Logs: Audit logs (/var/log/audit/audit.log) showing unusual unshare or clone syscalls creating new user/network namespaces followed by rapid nft or netlink activity.
• File System: Unexpected SUID binaries or new files in /tmp, /dev/shm, or world-writable directories created shortly after namespace creation events.

Apply the upstream kernel patches that enforce table-scoped SET_ID lookups in nf_tables. Fixed versions include Linux kernel 4.19.256, 5.4.211, 5.10.137, 5.15.61, 5.18.18, and 5.19.2 (Feedly, Kernel Patch). A SUSE advisory (SUSE-2025-02308-1) has also been issued for downstream distributions (Linux Security). As a workaround where patching is not immediately possible, restrict unprivileged user namespace creation by setting kernel.unprivileged_userns_clone=0 (on supported distributions) or user.max_user_namespaces=0 via sysctl, which prevents low-privileged users from obtaining CAP_NET_ADMIN and accessing nftables.

A SUSE security advisory (SUSE-2025-02308-1) was published addressing this and related Linux kernel vulnerabilities, rated as Important (Linux Security). Tenable has added detection coverage for this CVE across multiple plugin updates (Tenable). No significant independent researcher commentary or broad social media discussion specific to CVE-2022-50213 (as distinct from the related CVE-2022-2586) was identified.