CVE-2022-50780 in Linux
Summary
by MITRE • 12/24/2025
In the Linux kernel, the following vulnerability has been resolved:
net: fix UAF issue in nfqnl_nf_hook_drop() when ops_init() failed
When the ops_init() interface is invoked to initialize the net, but ops->init() fails, data is released. However, the ptr pointer in net->gen is invalid. In this case, when nfqnl_nf_hook_drop() is invoked to release the net, invalid address access occurs.
The process is as follows: setup_net() ops_init() data = kzalloc(...) ---> alloc "data" net_assign_generic() ---> assign "date" to ptr in net->gen ... ops->init() ---> failed ... kfree(data); ---> ptr in net->gen is invalid ... ops_exit_list() ... nfqnl_nf_hook_drop() *q = nfnl_queue_pernet(net) ---> q is invalid
The following is the Call Trace information: BUG: KASAN: use-after-free in nfqnl_nf_hook_drop+0x264/0x280 Read of size 8 at addr ffff88810396b240 by task ip/15855 Call Trace: <TASK> dump_stack_lvl+0x8e/0xd1 print_report+0x155/0x454 kasan_report+0xba/0x1f0 nfqnl_nf_hook_drop+0x264/0x280 nf_queue_nf_hook_drop+0x8b/0x1b0 __nf_unregister_net_hook+0x1ae/0x5a0 nf_unregister_net_hooks+0xde/0x130 ops_exit_list+0xb0/0x170 setup_net+0x7ac/0xbd0 copy_net_ns+0x2e6/0x6b0 create_new_namespaces+0x382/0xa50 unshare_nsproxy_namespaces+0xa6/0x1c0 ksys_unshare+0x3a4/0x7e0 __x64_sys_unshare+0x2d/0x40 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 </TASK>
Allocated by task 15855: kasan_save_stack+0x1e/0x40 kasan_set_track+0x21/0x30 __kasan_kmalloc+0xa1/0xb0 __kmalloc+0x49/0xb0 ops_init+0xe7/0x410 setup_net+0x5aa/0xbd0 copy_net_ns+0x2e6/0x6b0 create_new_namespaces+0x382/0xa50 unshare_nsproxy_namespaces+0xa6/0x1c0 ksys_unshare+0x3a4/0x7e0 __x64_sys_unshare+0x2d/0x40 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0
Freed by task 15855: kasan_save_stack+0x1e/0x40 kasan_set_track+0x21/0x30 kasan_save_free_info+0x2a/0x40 ____kasan_slab_free+0x155/0x1b0 slab_free_freelist_hook+0x11b/0x220 __kmem_cache_free+0xa4/0x360 ops_init+0xb9/0x410 setup_net+0x5aa/0xbd0 copy_net_ns+0x2e6/0x6b0 create_new_namespaces+0x382/0xa50 unshare_nsproxy_namespaces+0xa6/0x1c0 ksys_unshare+0x3a4/0x7e0 __x64_sys_unshare+0x2d/0x40 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 04/22/2026
The vulnerability described in CVE-2022-50780 resides within the Linux kernel's networking subsystem, specifically in the netfilter queue handling mechanism. This issue manifests as a use-after-free condition that occurs during the initialization and cleanup of network namespaces. The flaw is particularly significant because it can be exploited to cause system instability or potentially enable privilege escalation, depending on the execution context. The vulnerability stems from improper handling of memory management when the initialization of netfilter queue operations fails, leading to a scenario where freed memory is accessed later during namespace teardown. The root cause is tied to the interaction between the setup_net function and the ops_init interface, which allocates memory and assigns it to a generic net structure, but fails to properly manage the pointer state when the subsequent initialization step fails.
The technical execution of this vulnerability involves a sequence of operations that begin with the setup_net function invoking ops_init to allocate and initialize network resources. During this process, memory is allocated via kzalloc and assigned to a pointer within the net->gen structure using net_assign_generic. However, when the subsequent ops->init() call fails, the allocated data is freed through kfree, leaving the pointer in net->gen pointing to freed memory. When the cleanup process later invokes nfqnl_nf_hook_drop, it attempts to access the invalid pointer through nfnl_queue_pernet, resulting in a use-after-free condition that triggers a kernel memory safety violation. This memory access pattern is detected by the kernel's KASAN (Kernel Address Sanitizer) subsystem, which generates a detailed call trace showing the sequence of function calls leading to the invalid memory access.
The operational impact of this vulnerability extends beyond simple system crashes, as it represents a potential attack vector for privilege escalation and denial-of-service conditions. The flaw occurs during namespace creation and destruction, which are common operations in containerized environments and network management scenarios. An attacker could potentially exploit this condition by triggering namespace creation followed by a controlled failure during initialization, then causing the cleanup path to execute, thereby gaining access to freed memory. This situation aligns with CWE-416, which defines use-after-free vulnerabilities as a critical class of memory safety issues. The ATT&CK framework categorizes such vulnerabilities under the T1068 technique of Exploitation for Privilege Escalation, as they can be leveraged to gain elevated system privileges through kernel memory corruption.
Mitigation strategies for this vulnerability primarily focus on ensuring proper memory management during initialization failure scenarios and implementing defensive programming practices within the kernel. The most effective approach involves modifying the initialization sequence to prevent the assignment of pointers to freed memory, either by ensuring that net_assign_generic is only called after successful initialization or by implementing proper cleanup logic that invalidates pointers before memory is freed. Kernel patches addressing this issue typically include checks to ensure that memory is not accessed after being freed, and may involve adding additional validation steps in the ops_init and ops_exit_list functions to prevent the invalid pointer dereference. System administrators should ensure that all kernel updates are applied promptly to mitigate this vulnerability, as it affects the core networking functionality of Linux systems and can be exploited in various operational contexts including container orchestration platforms and network security appliances.