CVE-2022-32250

What it actually does

Incorrect NFT_STATEFUL_EXPR validation in nf_tables_api.c creates a use-after-free condition that a local user with user/net namespace creation rights can trigger to corrupt kernel memory and escalate to root.

Why it matters to the business

A local attacker on an affected Linux system can obtain full root control, allowing complete compromise of the host, data theft, persistence, or lateral movement; the vulnerability remains exploitable on many unpatched distributions and embedded devices years after disclosure.

How an attack unfolds

An attacker with local access creates user and network namespaces, loads a malicious nftables ruleset that exercises the flawed stateful expression path, triggers the use-after-free during rule processing, and uses the resulting memory corruption to overwrite kernel structures and execute code as root.

How to fix it

Upgrade the Linux kernel to a version containing the corrected NFT_STATEFUL_EXPR handling (post-5.18.1 mainline or the equivalent backported fix in the distribution kernel); rebuild and reboot all affected systems; where immediate patching is impossible, restrict unprivileged namespace creation via kernel.unprivileged_userns_clone=0 or equivalent sysctl.

How to confirm the fix worked

Verify running kernel version is newer than 5.18.1 and contains the nf_tables fix; confirm nftables stateful expression paths no longer permit the original use-after-free sequence; test that unprivileged namespace creation is blocked if that mitigation is applied.

Typical attack path

1. Obtain local shell on target Linux system
2. Create new user and network namespaces
3. Craft and load nftables rules containing stateful expressions
4. Trigger rule evaluation to induce use-after-free
5. Leverage memory corruption for privilege escalation to root

How to detect it

Review system logs for unexpected nftables rule loads from unprivileged users, namespace creation events followed by kernel oops or crashes, and any post-exploitation activity such as new root processes or unauthorized module loads; correlate with auditd or eBPF traces of nftables API calls.

What your security team should do

• Prioritize kernel upgrades on all internet-facing or multi-tenant Linux hosts
• Disable unprivileged user namespaces where not required
• Monitor for new public exploits targeting this use-after-free pattern
• Include the affected nftables code paths in future kernel security regression tests