Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.5
CVE-2022-49358: Linux kernel nf_tables can leak memory
CVE-2022-49358 · published 1 year ago
Summary
The nf_tables component in the Linux kernel can leave behind unused memory when certain flow rules are aborted, potentially slowing down the system over time. This affects Linux kernel installations, including the standard kernel and the HWE, HWE‑Edge, AWS‑5.4, and Azure‑5.4 builds from Canonical. Install the latest kernel updates from your distribution to apply the fix that correctly releases the memory.
What to do
- Update canonical linux-aws-5.4 to version 5.4.0-1085.92~18.04.1.
- Update canonical linux-azure-5.4 to version 5.4.0-1091.96~18.04.1.
- Update canonical linux-gcp-5.4 to version 5.4.0-1089.97~18.04.1.
- Update canonical linux-hwe-5.4 to version 5.4.0-126.142~18.04.1.
- Update canonical linux-ibm-5.4 to version 5.4.0-1033.37~18.04.1.
- Update canonical linux-oracle-5.4 to version 5.4.0-1083.91~18.04.1.
- Update canonical linux-raspi-5.4 to version 5.4.0-1070.80~18.04.1.
- Update canonical linux to version 5.4.0-126.142.
- Update canonical linux-aws to version 5.4.0-1085.92.
- Update canonical linux-aws-5.15 to version 5.15.0-1020.24~20.04.1.
- Update canonical linux-azure to version 5.4.0-1091.96.
- Update canonical linux-azure-5.15 to version 5.15.0-1020.25~20.04.1.
- Update canonical linux-bluefield to version 5.4.0-1046.51.
- Update canonical linux-gcp to version 5.4.0-1089.97.
- Update canonical linux-gcp-5.15 to version 5.15.0-1018.24~20.04.1.
- Update canonical linux-hwe-5.15 to version 5.15.0-48.54~20.04.1.
- Update canonical linux-ibm to version 5.4.0-1033.37.
- Update canonical linux-intel-iotg-5.15 to version 5.15.0-1016.21~20.04.1.
- Update canonical linux-iot to version 5.4.0-1004.6.
- Update canonical linux-kvm to version 5.4.0-1075.80.
- Update canonical linux-lowlatency-hwe-5.15 to version 5.15.0-48.54~20.04.1.
- Update canonical linux-oracle to version 5.4.0-1083.91.
- Update canonical linux-oracle-5.15 to version 5.15.0-1018.23~20.04.1.
- Update canonical linux-raspi to version 5.4.0-1070.80.
- Update canonical linux-riscv-5.15 to version 5.15.0-1019.22~20.04.1.
- Update canonical linux-aws-fips to version 5.4.0-1085.92+fips1.
- Update canonical linux-azure-fips to version 5.4.0-1091.96+fips1.
- Update canonical linux-fips to version 5.4.0-1061.69.
- Update canonical linux-gcp-fips to version 5.4.0-1089.97+fips1.
- Update canonical linux to version 5.15.0-48.54.
- Update canonical linux-aws to version 5.15.0-1020.24.
- Update canonical linux-azure to version 5.15.0-1020.25.
- Update canonical linux-gcp to version 5.15.0-1018.24.
- Update canonical linux-gke to version 5.15.0-1016.19.
- Update canonical linux-gkeop to version 5.15.0-1003.5.
- Update canonical linux-ibm to version 5.15.0-1015.17.
- Update canonical linux-intel-iotg to version 5.15.0-1016.21.
- Update canonical linux-kvm to version 5.15.0-1018.22.
- Update canonical linux-lowlatency to version 5.15.0-48.54.
- Update canonical linux-nvidia to version 5.15.0-1007.7.
- Update canonical linux-oracle to version 5.15.0-1018.23.
- Update canonical linux-raspi to version 5.15.0-1015.17.
- Update canonical linux-realtime to version 5.15.0-1021.21.
- Update canonical linux-azure-fde to version 5.15.0-1024.30.1.
- Update debian linux to version 5.18.5-1.
- Update linux kernel to version 5.18.4.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | linux | linux_kernel |
>= 5.3, < 5.4.198 >= 5.5, < 5.10.122 >= 5.11, < 5.15.47 >= 5.16, < 5.17.15 >= 5.18, < 5.18.4 5.19 cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Ubuntu:18.04:LTS | canonical | linux-hwe | All versions |
| Ubuntu:16.04:LTS | canonical | linux-hwe-edge | All versions |
| Ubuntu:18.04:LTS | canonical | linux-aws-5.4 |
< 5.4.0-1085.92~18.04.1 Fix: upgrade to 5.4.0-1085.92~18.04.1
|
| Ubuntu:18.04:LTS | canonical | linux-azure-5.4 |
< 5.4.0-1091.96~18.04.1 Fix: upgrade to 5.4.0-1091.96~18.04.1
|
| Ubuntu:18.04:LTS | canonical | linux-gcp-5.4 |
< 5.4.0-1089.97~18.04.1 Fix: upgrade to 5.4.0-1089.97~18.04.1
|
| Ubuntu:18.04:LTS | canonical | linux-hwe-5.4 |
< 5.4.0-126.142~18.04.1 Fix: upgrade to 5.4.0-126.142~18.04.1
|
| Ubuntu:18.04:LTS | canonical | linux-ibm-5.4 |
< 5.4.0-1033.37~18.04.1 Fix: upgrade to 5.4.0-1033.37~18.04.1
|
| Ubuntu:18.04:LTS | canonical | linux-oracle-5.4 |
< 5.4.0-1083.91~18.04.1 Fix: upgrade to 5.4.0-1083.91~18.04.1
|
| Ubuntu:18.04:LTS | canonical | linux-raspi-5.4 |
< 5.4.0-1070.80~18.04.1 Fix: upgrade to 5.4.0-1070.80~18.04.1
|
| Ubuntu:18.04:LTS | canonical | linux-aws-5.0 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-aws-5.3 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-azure | All versions |
| Ubuntu:18.04:LTS | canonical | linux-azure-5.3 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-azure-edge | All versions |
| Ubuntu:18.04:LTS | canonical | linux-gcp | All versions |
| Ubuntu:18.04:LTS | canonical | linux-gcp-5.3 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-gke-4.15 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-gke-5.4 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-gkeop-5.4 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-hwe-edge | All versions |
| Ubuntu:18.04:LTS | canonical | linux-oem | All versions |
| Ubuntu:18.04:LTS | canonical | linux-oracle-5.0 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-oracle-5.3 | All versions |
| Ubuntu:20.04:LTS | canonical | linux |
< 5.4.0-126.142 Fix: upgrade to 5.4.0-126.142
|
| Ubuntu:20.04:LTS | canonical | linux-aws |
< 5.4.0-1085.92 Fix: upgrade to 5.4.0-1085.92
|
| Ubuntu:20.04:LTS | canonical | linux-aws-5.15 |
< 5.15.0-1020.24~20.04.1 Fix: upgrade to 5.15.0-1020.24~20.04.1
|
| Ubuntu:20.04:LTS | canonical | linux-azure |
< 5.4.0-1091.96 Fix: upgrade to 5.4.0-1091.96
|
| Ubuntu:20.04:LTS | canonical | linux-azure-5.15 |
< 5.15.0-1020.25~20.04.1 Fix: upgrade to 5.15.0-1020.25~20.04.1
|
| Ubuntu:20.04:LTS | canonical | linux-bluefield |
< 5.4.0-1046.51 Fix: upgrade to 5.4.0-1046.51
|
| Ubuntu:20.04:LTS | canonical | linux-gcp |
< 5.4.0-1089.97 Fix: upgrade to 5.4.0-1089.97
|
| Ubuntu:20.04:LTS | canonical | linux-gcp-5.15 |
< 5.15.0-1018.24~20.04.1 Fix: upgrade to 5.15.0-1018.24~20.04.1
|
| Ubuntu:20.04:LTS | canonical | linux-hwe-5.15 |
< 5.15.0-48.54~20.04.1 Fix: upgrade to 5.15.0-48.54~20.04.1
|
| Ubuntu:20.04:LTS | canonical | linux-ibm |
< 5.4.0-1033.37 Fix: upgrade to 5.4.0-1033.37
|
| Ubuntu:20.04:LTS | canonical | linux-intel-iotg-5.15 |
< 5.15.0-1016.21~20.04.1 Fix: upgrade to 5.15.0-1016.21~20.04.1
|
| Ubuntu:20.04:LTS | canonical | linux-iot |
< 5.4.0-1004.6 Fix: upgrade to 5.4.0-1004.6
|
| Ubuntu:20.04:LTS | canonical | linux-kvm |
< 5.4.0-1075.80 Fix: upgrade to 5.4.0-1075.80
|
| Ubuntu:20.04:LTS | canonical | linux-lowlatency-hwe-5.15 |
< 5.15.0-48.54~20.04.1 Fix: upgrade to 5.15.0-48.54~20.04.1
|
| Ubuntu:20.04:LTS | canonical | linux-oracle |
< 5.4.0-1083.91 Fix: upgrade to 5.4.0-1083.91
|
| Ubuntu:20.04:LTS | canonical | linux-oracle-5.15 |
< 5.15.0-1018.23~20.04.1 Fix: upgrade to 5.15.0-1018.23~20.04.1
|
| Ubuntu:20.04:LTS | canonical | linux-raspi |
< 5.4.0-1070.80 Fix: upgrade to 5.4.0-1070.80
|
| Ubuntu:20.04:LTS | canonical | linux-riscv-5.15 |
< 5.15.0-1019.22~20.04.1 Fix: upgrade to 5.15.0-1019.22~20.04.1
|
| Ubuntu:20.04:LTS | canonical | linux-aws-5.11 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-aws-5.13 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-aws-5.8 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-azure-5.11 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-azure-5.13 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-azure-5.8 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-azure-fde | All versions |
| Ubuntu:20.04:LTS | canonical | linux-gcp-5.11 | All versions |
Showing 50 of 131. Show the rest
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Ubuntu:20.04:LTS | canonical | linux-gcp-5.13 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-gcp-5.8 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-gke | All versions |
| Ubuntu:20.04:LTS | canonical | linux-gke-5.15 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-gkeop | All versions |
| Ubuntu:20.04:LTS | canonical | linux-gkeop-5.15 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-hwe-5.11 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-hwe-5.13 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-hwe-5.8 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-intel-5.13 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-oem-5.10 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-oem-5.13 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-oem-5.14 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-oem-5.6 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-oracle-5.11 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-oracle-5.13 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-oracle-5.8 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-raspi2 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-riscv | All versions |
| Ubuntu:20.04:LTS | canonical | linux-riscv-5.11 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-riscv-5.8 | All versions |
| Ubuntu:Pro:FIPS-updates:20.04:LTS | canonical | linux-aws-fips |
< 5.4.0-1085.92+fips1 Fix: upgrade to 5.4.0-1085.92+fips1
|
| Ubuntu:Pro:FIPS-updates:20.04:LTS | canonical | linux-azure-fips |
< 5.4.0-1091.96+fips1 Fix: upgrade to 5.4.0-1091.96+fips1
|
| Ubuntu:Pro:FIPS-updates:20.04:LTS | canonical | linux-fips |
< 5.4.0-1061.69 Fix: upgrade to 5.4.0-1061.69
|
| Ubuntu:Pro:FIPS-updates:20.04:LTS | canonical | linux-gcp-fips |
< 5.4.0-1089.97+fips1 Fix: upgrade to 5.4.0-1089.97+fips1
|
| Ubuntu:Pro:FIPS:20.04:LTS | canonical | linux-aws-fips | All versions |
| Ubuntu:Pro:FIPS:20.04:LTS | canonical | linux-azure-fips | All versions |
| Ubuntu:Pro:FIPS:20.04:LTS | canonical | linux-fips | All versions |
| Ubuntu:Pro:FIPS:20.04:LTS | canonical | linux-gcp-fips | All versions |
| Ubuntu:22.04:LTS | canonical | linux |
< 5.15.0-48.54 Fix: upgrade to 5.15.0-48.54
|
| Ubuntu:22.04:LTS | canonical | linux-allwinner-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-aws |
< 5.15.0-1020.24 Fix: upgrade to 5.15.0-1020.24
|
| Ubuntu:22.04:LTS | canonical | linux-aws-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-aws-6.2 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-aws-6.5 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-azure |
< 5.15.0-1020.25 Fix: upgrade to 5.15.0-1020.25
|
| Ubuntu:22.04:LTS | canonical | linux-azure-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-azure-6.2 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-azure-6.5 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-azure-fde |
< 5.15.0-1024.30.1 Fix: upgrade to 5.15.0-1024.30.1
|
| Ubuntu:22.04:LTS | canonical | linux-azure-fde-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-azure-fde-6.2 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-gcp |
< 5.15.0-1018.24 Fix: upgrade to 5.15.0-1018.24
|
| Ubuntu:22.04:LTS | canonical | linux-gcp-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-gcp-6.2 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-gcp-6.5 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-gke |
< 5.15.0-1016.19 Fix: upgrade to 5.15.0-1016.19
|
| Ubuntu:22.04:LTS | canonical | linux-gkeop |
< 5.15.0-1003.5 Fix: upgrade to 5.15.0-1003.5
|
| Ubuntu:22.04:LTS | canonical | linux-hwe-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-hwe-6.2 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-hwe-6.5 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-ibm |
< 5.15.0-1015.17 Fix: upgrade to 5.15.0-1015.17
|
| Ubuntu:22.04:LTS | canonical | linux-intel-iot-realtime | All versions |
| Ubuntu:22.04:LTS | canonical | linux-intel-iotg |
< 5.15.0-1016.21 Fix: upgrade to 5.15.0-1016.21
|
| Ubuntu:22.04:LTS | canonical | linux-kvm |
< 5.15.0-1018.22 Fix: upgrade to 5.15.0-1018.22
|
| Ubuntu:22.04:LTS | canonical | linux-lowlatency |
< 5.15.0-48.54 Fix: upgrade to 5.15.0-48.54
|
| Ubuntu:22.04:LTS | canonical | linux-lowlatency-hwe-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-lowlatency-hwe-6.2 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-lowlatency-hwe-6.5 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-nvidia |
< 5.15.0-1007.7 Fix: upgrade to 5.15.0-1007.7
|
| Ubuntu:22.04:LTS | canonical | linux-nvidia-6.2 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-nvidia-6.5 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-oem-5.17 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-oem-6.0 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-oem-6.1 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-oem-6.5 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-oracle |
< 5.15.0-1018.23 Fix: upgrade to 5.15.0-1018.23
|
| Ubuntu:22.04:LTS | canonical | linux-oracle-6.5 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-raspi |
< 5.15.0-1015.17 Fix: upgrade to 5.15.0-1015.17
|
| Ubuntu:22.04:LTS | canonical | linux-realtime | All versions |
| Ubuntu:22.04:LTS | canonical | linux-riscv | All versions |
| Ubuntu:22.04:LTS | canonical | linux-riscv-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-riscv-6.5 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-starfive-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-starfive-6.2 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-starfive-6.5 | All versions |
| Ubuntu:Pro:Realtime:22.04:LTS | canonical | linux-realtime |
< 5.15.0-1021.21 Fix: upgrade to 5.15.0-1021.21
|
| Ubuntu:24.04:LTS | canonical | linux-raspi-realtime | All versions |
| Ubuntu:26.04 | canonical | linux-nvidia | All versions |
| Debian:12 | debian | linux |
< 5.18.5-1 Fix: upgrade to 5.18.5-1
|
| Linux | linux | kernel |
>= 5.18.0, < 5.18.4 Fix: upgrade to 5.18.4
|
Original advisory text
netfilter: nf_tables: memleak flow rule from commit path
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: memleak flow rule from commit path Abort path release flow rule object, however, commit path does not. Update code to destroy these objects before releasing the transaction.
References
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49358... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2022-49358 Vendor Advisory
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git Product
- https://git.kernel.org/stable/c/80de9ea1f5b808a6601e91111fae601df2b26369 URL
- https://git.kernel.org/linus/9dd732e0bdf538b1b76dc7c157e2b5e560ff30d3 Third Party Advisory
- https://ubuntu.com/security/CVE-2022-49358 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2022-49358 Third Party Advisory
- https://security-tracker.debian.org/tracker/CVE-2022-49358 Vendor Advisory
- https://git.kernel.org/stable/c/9dd732e0bdf538b1b76dc7c157e2b5e560ff30d3 URL
- https://git.kernel.org/stable/c/ab9f34a30c23f656e76f4c5b83125a4e7b53c86e URL
- https://git.kernel.org/stable/c/e33d9bd563e71f6c6528b96008d65524a459c4dc URL
- https://git.kernel.org/stable/c/330c0c6cd2150a2d7f47af16aa590078b0d2f736 URL
- https://git.kernel.org/stable/c/5b8d63489c3b701eb2a76f848ec94d8cbc9373b9 URL
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-401Memory Leak
Timeline
Published26 Feb 2025
Updated3 Nov 2026
First seen7 Mar 2026
Sources
CVE-2022-49358 · NVD
CVE-2022-49358 · OSV
UBUNTU-CVE-2022-49358 · OSV
DEBIAN-CVE-2022-49358 · OSV
Track software like this
Free during beta