CVE-2022-49561
This vulnerability in the Linux kernel’s netfilter conntrack subsystem allows an attacker to trigger a race condition that can corrupt memory. The flaw can be exploited remotely without authentication or user interaction, potentially causing a system crash or privilege escalation.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
All Linux kernel users running a kernel version before the fix, across all distributions that ship the affected kernel.
Real-world impact
An attacker could crash the system, corrupt data, or potentially gain elevated privileges, leading to denial of service or full system compromise.
Why this severity
The CVSS score of 9.8 reflects that the flaw is exploitable remotely with no authentication, no user interaction, and can compromise confidentiality, integrity, and availability.
What to do about it
- 01Update your Linux kernel to the latest stable release that includes the fix for CVE-2022-49561.
- 02Reboot the system to load the new kernel.
NVD-referenced vendor advisory
Timeline
- Feb 26, 2025 · Feb 26, 2025PublishedDisclosed and added to the National Vulnerability Database.
- Aug 4, 2026 · 2d agoAdvisory updatedThe NVD record was last revised.
- Aug 4, 2026 · 1d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
How it’s attacked
References & advisories
- git.kernel.org/stable/c/01989d7eebb61c99bd…patch
- git.kernel.org/stable/c/04e4a11dc723c52db7…patch
- git.kernel.org/stable/c/04f9e9104c969d8ce1…patch
- git.kernel.org/stable/c/56b14ecec97f39118b…patch
- git.kernel.org/stable/c/91a36ec160ec1a0c8f…patch
- git.kernel.org/stable/c/92a999d1963eed0df6…patch
- git.kernel.org/stable/c/b16bb373988da3ceb0…patch
- git.kernel.org/stable/c/e97222b785e70e8973…patch