HighFix available
netfilter: nf_queue: fix possible use-after-free
Type: advisorySources: OSV
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_queue: fix possible use-after-free Eric Dumazet says: The sock_hold() side seems suspect, because there is no guarantee that sk_refcnt is not already 0. On failure, we cannot queue the packet and need to indicate an error. The packet will be dropped by the caller. v2: split skb prefetch hunk into separate change
- Products
- Kernel
- Affected versions
- Not specified
- Fixed versions
- 4.14.270, 4.19.233, 4.9.305, 5.10.104, 5.15.27, 5.16.13, 5.4.183
- CVEs
- CVE-2022-48911
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 3 Nov 2026, 17:32 UTC · Revision 1
Source evidence
netfilter: nf_queue: fix possible use-after-free
core-osv · Original sourcePublished 22 Aug 2024, 01:31 UTC
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_queue: fix possible use-after-free Eric Dumazet says: The sock_hold() side seems suspect, because there is no guarantee that sk_refcnt is not already 0. On failure, we cannot queue the packet and need to indicate an error. The packet will be dropped by the caller. v2: split skb prefetch hunk into separate change
osv:CVE-2022-48911
Kernel
Fixed versions: 4.9.305, 4.14.270, 4.19.233, 5.4.183, 5.10.104, 5.15.27, 5.16.13
Complete source record
{
"id": "6af7cb87344cd7dca0e203ab0623dabca38c565df17833bd004478fe31b140f9",
"url": "https://osv.dev/vulnerability/CVE-2022-48911",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "netfilter: nf_queue: fix possible use-after-free",
"summary": "In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_queue: fix possible use-after-free Eric Dumazet says: The sock_hold() side seems suspect, because there is no guarantee that sk_refcnt is not already 0. On failure, we cannot queue the packet and need to indicate an error. The packet will be dropped by the caller. v2: split skb prefetch hunk into separate change",
"evidence": "osv:CVE-2022-48911",
"products": [
{
"name": {
"value": "Kernel",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "4.9.305",
"evidence": "/affected/1/ranges"
},
{
"value": "4.14.270",
"evidence": "/affected/1/ranges"
},
{
"value": "4.19.233",
"evidence": "/affected/1/ranges"
},
{
"value": "5.4.183",
"evidence": "/affected/1/ranges"
},
{
"value": "5.10.104",
"evidence": "/affected/1/ranges"
},
{
"value": "5.15.27",
"evidence": "/affected/1/ranges"
},
{
"value": "5.16.13",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
}
],
"severity": "high",
"structured": {
"id": "CVE-2022-48911",
"aliases": [
"CVE-2022-48911"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "271b72c7fa82c2c7a795bc16896149933110672d"
},
{
"fixed": "21b27b2baa27423286e9b8d3f0b194d587083d95"
},
{
"fixed": "ef97921ccdc243170fcef857ba2a17cf697aece5"
},
{
"fixed": "34dc4a6a7f261736ef7183868a5bddad31c7f9e3"
},
{
"fixed": "43c25da41e3091b31a906651a43e80a2719aa1ff"
},
{
"fixed": "4d05239203fa38ea8a6f31e228460da4cb17a71a"
},
{
"fixed": "dd648bd1b33a828f62befa696b206c688da0ec43"
},
{
"fixed": "dcc3cb920bf7ba66ac5e9272293a9ba5f80917ee"
},
{
"fixed": "c3873070247d9e3c7a6b0cf9bf9b45e8018427b1"
}
]
}
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-48911.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.6.29"
},
{
"fixed": "4.9.305"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.10.0"
},
{
"fixed": "4.14.270"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.15.0"
},
{
"fixed": "4.19.233"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.20.0"
},
{
"fixed": "5.4.183"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.5.0"
},
{
"fixed": "5.10.104"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.11.0"
},
{
"fixed": "5.15.27"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.16.0"
},
{
"fixed": "5.16.13"
}
]
}
],
"package": {
"name": "Kernel",
"ecosystem": "Linux"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-48911.json"
}
}
],
"modified": "2026-10-28T02:30:31.259034789Z",
"provider": "osv",
"references": [
"https://git.kernel.org/stable/c/21b27b2baa27423286e9b8d3f0b194d587083d95",
"https://git.kernel.org/stable/c/34dc4a6a7f261736ef7183868a5bddad31c7f9e3",
"https://git.kernel.org/stable/c/43c25da41e3091b31a906651a43e80a2719aa1ff",
"https://git.kernel.org/stable/c/4d05239203fa38ea8a6f31e228460da4cb17a71a",
"https://git.kernel.org/stable/c/c3873070247d9e3c7a6b0cf9bf9b45e8018427b1",
"https://git.kernel.org/stable/c/dcc3cb920bf7ba66ac5e9272293a9ba5f80917ee",
"https://git.kernel.org/stable/c/dd648bd1b33a828f62befa696b206c688da0ec43",
"https://git.kernel.org/stable/c/ef97921ccdc243170fcef857ba2a17cf697aece5",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/48xxx/CVE-2022-48911.json",
"https://nvd.nist.gov/vuln/detail/CVE-2022-48911",
"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
],
"provider_metadata": {
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/48xxx/CVE-2022-48911.json"
}
},
"related_cves": [
{
"value": "CVE-2022-48911",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 497868,
"published_at": "2024-08-22T01:31:07.463+00:00"
}