CVE-2022-36946

What it actually does

Remote attacker can trigger kernel panic via nfqnl_mangle in nfnetlink_queue when an nf_queue verdict supplies a one-byte nfta_payload attribute, causing skb_pull to compute a negative skb->len.

Why it matters to the business

Systems using netfilter queue functionality can experience unexpected crashes and service outages; high prevalence of the Linux kernel increases exposure across servers and appliances.

How an attack unfolds

Attacker crafts a network packet that reaches the netfilter queue path, supplies a one-byte nfta_payload attribute in the verdict, and forces the kernel into skb_pull with negative length, resulting in immediate panic.

How to fix it

Apply the upstream fix in commit 99a63d36cb3ed5ca3aa6fcb64cffbeaf3b0fb164 or later; update to a maintained kernel branch containing this commit.

How to confirm the fix worked

Verify the running kernel contains commit 99a63d36cb3ed5ca3aa6fcb64cffbeaf3b0fb164 via git log or kernel version string; test nfqueue paths with one-byte payload attributes.

Typical attack path

1. Send crafted packet that matches an nfqueue rule
2. Kernel invokes nf_queue verdict handler with malformed nfta_payload
3. nfqnl_mangle performs skb_pull on undersized buffer
4. skb->len becomes negative, triggering kernel panic

How to detect it

Search kernel logs and crash dumps for nfqnl_mangle, skb_pull negative length, or nfnetlink_queue panics; correlate with inbound packets matching nfqueue rules.

• nfqnl_mangle
• skb_pull.*negative
• nf_queue verdict.*nfta_payload

What your security team should do

• Prioritize kernel upgrade to a version containing commit 99a63d36cb3ed5ca3aa6fcb64cffbeaf3b0fb164 on all exposed systems
• Monitor for nfqueue-related kernel panics in system logs
• Review netfilter rules to minimize unnecessary nfqueue usage until patched