CVE-2022-2586

What it actually does

CVE-2022-2586 is a Linux kernel use-after-free vulnerability in the nftables subsystem. The flaw allows a nftables object or expression to incorrectly reference an nft set from a different nft table; when that table is deleted, the kernel may continue using a freed memory object. A local attacker with sufficient ability to interact with nftables, commonly through local privileges and in some configurations user namespaces, can trigger memory corruption in kernel space. Successful exploitation can lead to local privilege escalation, kernel code execution, system compromise, or denial of service through a kernel crash.

Why it matters to the business

Systems running vulnerable Linux kernels, including affected Ubuntu releases, may allow a local user or attacker who has already gained limited shell access to become root. Because this vulnerability is listed in CISA KEV with active in-the-wild exploitation and a remediation due date of 2024-07-17 for covered organizations, it should be treated as high priority even though it is not remotely exploitable by itself. The main operational risk is that an initial foothold from phishing, web compromise, stolen credentials, or container escape attempts can be escalated into full host control, enabling data theft, persistence, tampering, lateral movement, and service disruption.

How an attack unfolds

An attacker first needs local code execution or an interactive foothold on a vulnerable Linux host. They then exercise the nftables netfilter API to create nftables tables, sets, objects, or expressions in a way that causes an object or expression to reference a set owned by another table. The attacker deletes the referenced table, causing the kernel to free the nft set while another nftables object still holds a stale reference. By triggering later kernel operations against that stale reference, the attacker manipulates the use-after-free condition to corrupt kernel memory. A reliable exploit typically shapes heap allocations so the freed memory is replaced with attacker-controlled data, then pivots the corruption into privilege escalation, such as modifying process credentials or otherwise gaining root-equivalent execution. Public reporting and KEV status indicate exploitation has occurred in the wild; the supplied threat context appears to reference broader Linux kernel privilege-escalation activity rather than a confirmed named actor for this specific vulnerability.

How to fix it

Upgrade the Linux kernel to a vendor-supported version that includes the nftables use-after-free fix for CVE-2022-2586. For Ubuntu and other distributions, use the distribution security advisory and package manager rather than upstream kernel version strings, because fixes are often backported. Reboot into the patched kernel after installation; applying the package without rebooting usually leaves the vulnerable kernel active. Where immediate patching is not possible, reduce exposure by restricting local shell access, limiting untrusted workloads, disabling unprivileged user namespaces where operationally feasible, limiting container privileges, removing CAP_NET_ADMIN from containers and services that do not require it, and restricting use of nftables/netfilter management interfaces to trusted administrators. Treat mitigations as temporary because kernel memory-corruption vulnerabilities are difficult to reliably contain once an attacker has local execution.

How to confirm the fix worked

Confirm the running kernel, not only the installed package, is fixed. On Linux, compare `uname -r` with the distribution security advisory for the installed kernel package and verify the system has rebooted after the update. Check package metadata using tools such as `apt list --installed 'linux-image*'`, `dpkg -l 'linux-image*'`, `rpm -q kernel`, or the relevant vendor tooling. Validate that no vulnerable kernel remains selected by the bootloader. For mitigation validation, confirm unprivileged user namespaces are disabled where intended, containers do not retain unnecessary CAP_NET_ADMIN privileges, and only trusted administrative users can invoke nftables management operations. Vulnerability scanners should be configured to evaluate the running kernel and vendor backport status, not only upstream version numbers.

Typical attack path

1. Gain local execution on a vulnerable Linux system through another vulnerability, stolen credentials, malicious package, web shell, or compromised user account.
2. Check kernel version, nftables availability, namespace settings, and whether the current context can access netfilter/nftables functionality.
3. Create crafted nftables tables, sets, objects, or expressions that establish an invalid cross-table reference.
4. Delete the referenced nftables table to free the underlying set while a stale reference remains reachable.
5. Trigger nftables operations that dereference the freed object and corrupt kernel memory.
6. Use heap grooming and kernel memory corruption primitives to overwrite sensitive kernel structures or process credentials.
7. Obtain root privileges or kernel-level control, then deploy persistence, disable defenses, access sensitive data, or move laterally.

How to detect it

Detecting prior exploitation is difficult because successful exploitation occurs through kernel memory corruption and may leave few unique artifacts. Focus on correlating local access followed by suspicious nftables activity, kernel faults, and rapid privilege changes. Useful sources include auditd logs, shell history, process execution telemetry, EDR events, sudo/authentication logs, systemd journal, kernel logs, container runtime logs, and file-integrity monitoring. Look for unexpected execution of `nft`, unusual netlink/netfilter activity by non-administrative users, nftables table/set creation and deletion bursts, kernel oops/panic messages involving nf_tables or nftables, and sudden transitions from low-privilege users to root without normal sudo, su, or PAM traces. Also hunt for post-exploitation artifacts: newly created setuid-root files, modified `/etc/sudoers` or `/etc/sudoers.d/`, unauthorized SSH keys, new systemd services or timers, suspicious cron entries, unknown kernel modules, disabled security agents, and log tampering. If exploitation is suspected, preserve volatile evidence, collect kernel logs and audit data promptly, compare loaded kernel and module state against a trusted baseline, and perform broader incident response because successful exploitation likely grants full host control.

• execve nft
• /usr/sbin/nft
• /sbin/nft
• /usr/bin/nft
• nf_tables
• nftables
• kernel: BUG:
• kernel: Oops:
• kernel: general protection fault
• kernel: KASAN: use-after-free
• kernel: use-after-free
• kernel: RIP: nf_tables
• kernel: RIP: nft_
• kernel: WARNING: CPU:
• /etc/sudoers.d/
• /etc/cron.d/
• /var/spool/cron/
• /root/.ssh/authorized_keys
• /etc/systemd/system/
• CAP_NET_ADMIN
• kernel.unprivileged_userns_clone

What your security team should do

• Prioritize patching all affected Linux and Ubuntu systems because the vulnerability is in CISA KEV and has active in-the-wild exploitation activity.
• Identify internet-facing servers, multi-user systems, CI/CD runners, container hosts, Kubernetes nodes, bastion hosts, and systems that process untrusted workloads; patch and reboot these first.
• Verify patch completion by checking the active running kernel after reboot, not just package installation status.
• Temporarily disable unprivileged user namespaces where feasible and remove CAP_NET_ADMIN from containers or services that do not explicitly require network administration capabilities.
• Review recent local privilege-escalation alerts, unexpected root shells, suspicious nftables activity, kernel crashes, and user accounts that executed nft/nftables commands.
• Hunt for post-exploitation behavior such as new setuid binaries, unauthorized SSH keys, new root-level cron or systemd persistence, kernel module tampering, and defense-tool shutdowns.
• Apply least privilege to local users, service accounts, build systems, and container runtimes to reduce the chance that an initial foothold can reach nftables attack surface.
• Monitor vendor advisories for backported fixed kernel packages and ensure golden images, templates, and container host baselines are rebuilt with the fixed kernel.