Linux Kernel Use-After-Free Vulnerability (CVE-2022-2586)

A local attacker, with a low-privilege account, can achieve full data confidentiality loss, partial data tampering, complete denial of service or system unavailability. Federal agencies are required to remediate by 2024-07-17 under CISA BOD 22-01.

This is a Use After Free (CWE-416) vulnerability in Linux Kernel. It was discovered that a nft object or expression could reference a nft set on a different nft table, leading to a use-after-free once that table was deleted. Exploitation requires local access, higher attack complexity, a low-privilege authenticated account, and no user interaction required.

Probably yes if any of these apply:

Active exploitation documented in the wild. Threat-research write-up: https://www.vicarius.io/vsociety/posts/use-after-free-vulnerability-linked-chain-between-nft-tables-cve-2022-2586