CVE-2025-22064

What it actually does

A use-after-free in the nf_tables netfilter subsystem occurs when nf_tables_updchain attempts hook unregistration rollback on a dormant (inactive) table after an error, because the registration assignment was performed outside the conditional registration block.

Why it matters to the business

Local attackers may achieve privilege escalation or trigger kernel crashes on Linux systems running affected kernels, potentially leading to unauthorized access, data compromise, or service disruption across server and container workloads.

How an attack unfolds

An attacker loads or modifies an nftables configuration that triggers an error path inside nf_tables_updchain while the table remains dormant; the incorrect hook unregistration leaves a dangling reference that is later dereferenced, resulting in a use-after-free that can be turned into arbitrary kernel code execution or denial of service.

How to fix it

Upgrade the Linux kernel to a version containing commit 6134d1ea1e1408e8e7c8c26545b3b301cbdf1eda or apply the vendor-supplied packages (gnome-shell 0:40.10-19.el9_4 and corresponding debug packages on Red Hat Enterprise Linux 9.4 EUS). Reboot after kernel updates and verify nftables table state handling.

How to confirm the fix worked

Confirm the running kernel contains the referenced commit or fixed package versions; exercise nftables chain updates on dormant tables and monitor for use-after-free warnings or crashes in kernel logs.

Typical attack path

1. Identify systems running vulnerable Linux kernel versions with nf_tables enabled
2. Obtain local access or execute code as an unprivileged user
3. Load or update an nftables table marked dormant and trigger an error during chain update
4. Trigger the dangling hook reference to cause use-after-free
5. Leverage the use-after-free primitive for privilege escalation or kernel memory corruption

How to detect it

Review kernel logs (dmesg, /var/log/kern.log, journalctl) for nf_tables, nftables, and use-after-free warnings around chain update operations; correlate with any recent nftables configuration changes or table state transitions.

What your security team should do

• Prioritize kernel updates on all internet-facing and multi-tenant Linux hosts within the next patching cycle
• Restrict unprivileged users from loading or modifying nftables rules where feasible via SELinux or AppArmor policies
• Include netfilter/nf_tables error paths in regular kernel crash and log review processes
• Track downstream package updates for any dependent user-space components such as gnome-shell