# CVE-2022-50780: linux: In the Linux kernel, the following vulnerability has been resolved: net: fix UAF issue in nfqnl_nf_hook_drop() when... CVE-2022-50780 is fixed in 63 products on 1 platform, first by RHSA-2024:2394, released April 30, 2024. It is not reported as exploited. Patch Radar priority: High. - Web page: https://patchblox.com/security/cve/CVE-2022-50780 - Priority: High - CVSS: 7.8 (high) - EPSS: 0.0016 - CISA KEV: not listed - Exploited (vendor report): no - Publicly disclosed: no - Published: Apr 30, 2024 ## Description In the Linux kernel, the following vulnerability has been resolved: net: fix UAF issue in nfqnl_nf_hook_drop() when ops_init() failed When the ops_init() interface is invoked to initialize the net, but ops->init() fails, data is released. However, the ptr pointer in net->gen is invalid. In this case, when nfqnl_nf_hook_drop() is invoked to release the net, invalid address access occurs. The process is as follows: setup_net() ops_init() data = kzalloc(...) ---> alloc "data" net_assign_generic() ---> assign "date" to ptr in net->gen ... ops->init() ---> failed ... kfree(data); ---> ptr in net->gen is invalid ... ops_exit_list() ... nfqnl_nf_hook_drop() *q = nfnl_queue_pernet(net) ---> q is invalid The following is the Call Trace information: BUG: KASAN: use-after-free in nfqnl_nf_hook_drop+0x264/0x280 Read of size 8 at addr ffff88810396b240 by task ip/15855 Call Trace: dump_stack_lvl+0x8e/0xd1 print_report+0x155/0x454 kasan_report+0xba/0x1f0 nfqnl_nf_hook_drop+0x264/0x280 nf_queue_nf_hook_drop+0x8b/0x1b0 __nf_unregister_net_hook+0x1ae/0x5a0 nf_unregister_net_hooks+0xde/0x130 ops_exit_list+0xb0/0x170 setup_net+0x7ac/0xbd0 copy_net_ns+0x2e6/0x6b0 create_new_namespaces+0x382/0xa50 unshare_nsproxy_namespaces+0xa6/0x1c0 ksys_unshare+0x3a4/0x7e0 __x64_sys_unshare+0x2d/0x40 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 Allocated by task 15855: kasan_save_stack+0x1e/0x40 kasan_set_track+0x21/0x30 __kasan_kmalloc+0xa1/0xb0 __kmalloc+0x49/0xb0 ops_init+0xe7/0x410 setup_net+0x5aa/0xbd0 copy_net_ns+0x2e6/0x6b0 create_new_namespaces+0x382/0xa50 unshare_nsproxy_namespaces+0xa6/0x1c0 ksys_unshare+0x3a4/0x7e0 __x64_sys_unshare+0x2d/0x40 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 Freed by task 15855: kasan_save_stack+0x1e/0x40 kasan_set_track+0x21/0x30 kasan_save_free_info+0x2a/0x40 ____kasan_slab_free+0x155/0x1b0 slab_free_freelist_hook+0x11b/0x220 __kmem_cache_free+0xa4/0x360 ops_init+0xb9/0x410 setup_net+0x5aa/0xbd0 copy_net_ns+0x2e6/0x6b0 create_new_namespaces+0x382/0xa50 unshare_nsproxy_namespaces+0xa6/0x1c0 ksys_unshare+0x3a4/0x7e0 __x64_sys_unshare+0x2d/0x40 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 ## Where it's fixed | Platform | Product | Fixed in | Fix | Released | |---|---|---|---|---| | Linux | bpftool RHEL 9 | 0:7.3.0-427.13.1.el9_4 | [RHSA-2024:2394](https://patchblox.com/security/data/fix/linux/rhsa-2024-2394.md) | Apr 30, 2024 | | Linux | kernel RHEL 9 | 0:5.14.0-427.13.1.el9_4 | [RHSA-2024:2394](https://patchblox.com/security/data/fix/linux/rhsa-2024-2394.md) | Apr 30, 2024 | | Linux | kernel-64k RHEL 9 | 0:5.14.0-427.13.1.el9_4 | [RHSA-2024:2394](https://patchblox.com/security/data/fix/linux/rhsa-2024-2394.md) | Apr 30, 2024 | | Linux | kernel-64k-core RHEL 9 | 0:5.14.0-427.13.1.el9_4 | [RHSA-2024:2394](https://patchblox.com/security/data/fix/linux/rhsa-2024-2394.md) | Apr 30, 2024 | | Linux | kernel-64k-debug RHEL 9 | 0:5.14.0-427.13.1.el9_4 | [RHSA-2024:2394](https://patchblox.com/security/data/fix/linux/rhsa-2024-2394.md) | Apr 30, 2024 | | Linux | kernel-64k-debug-core RHEL 9 | 0:5.14.0-427.13.1.el9_4 | [RHSA-2024:2394](https://patchblox.com/security/data/fix/linux/rhsa-2024-2394.md) | Apr 30, 2024 | | Linux | kernel-64k-debug-devel RHEL 9 | 0:5.14.0-427.13.1.el9_4 | [RHSA-2024:2394](https://patchblox.com/security/data/fix/linux/rhsa-2024-2394.md) | Apr 30, 2024 | | Linux | kernel-64k-debug-devel-matched RHEL 9 | 0:5.14.0-427.13.1.el9_4 | [RHSA-2024:2394](https://patchblox.com/security/data/fix/linux/rhsa-2024-2394.md) | Apr 30, 2024 | | Linux | kernel-64k-debug-modules RHEL 9 | 0:5.14.0-427.13.1.el9_4 | [RHSA-2024:2394](https://patchblox.com/security/data/fix/linux/rhsa-2024-2394.md) | Apr 30, 2024 | | Linux | kernel-64k-debug-modules-core RHEL 9 | 0:5.14.0-427.13.1.el9_4 | [RHSA-2024:2394](https://patchblox.com/security/data/fix/linux/rhsa-2024-2394.md) | Apr 30, 2024 | | Linux | kernel-64k-debug-modules-extra RHEL 9 | 0:5.14.0-427.13.1.el9_4 | [RHSA-2024:2394](https://patchblox.com/security/data/fix/linux/rhsa-2024-2394.md) | Apr 30, 2024 | | Linux | kernel-64k-devel RHEL 9 | 0:5.14.0-427.13.1.el9_4 | [RHSA-2024:2394](https://patchblox.com/security/data/fix/linux/rhsa-2024-2394.md) | Apr 30, 2024 | | Linux | kernel-64k-devel-matched RHEL 9 | 0:5.14.0-427.13.1.el9_4 | [RHSA-2024:2394](https://patchblox.com/security/data/fix/linux/rhsa-2024-2394.md) | Apr 30, 2024 | | Linux | kernel-64k-modules RHEL 9 | 0:5.14.0-427.13.1.el9_4 | [RHSA-2024:2394](https://patchblox.com/security/data/fix/linux/rhsa-2024-2394.md) | Apr 30, 2024 | | Linux | kernel-64k-modules-core RHEL 9 | 0:5.14.0-427.13.1.el9_4 | [RHSA-2024:2394](https://patchblox.com/security/data/fix/linux/rhsa-2024-2394.md) | Apr 30, 2024 | | Linux | kernel-64k-modules-extra RHEL 9 | 0:5.14.0-427.13.1.el9_4 | [RHSA-2024:2394](https://patchblox.com/security/data/fix/linux/rhsa-2024-2394.md) | Apr 30, 2024 | | Linux | kernel-abi-stablelists RHEL 9 | 0:5.14.0-427.13.1.el9_4 | [RHSA-2024:2394](https://patchblox.com/security/data/fix/linux/rhsa-2024-2394.md) | Apr 30, 2024 | | Linux | kernel-core RHEL 9 | 0:5.14.0-427.13.1.el9_4 | [RHSA-2024:2394](https://patchblox.com/security/data/fix/linux/rhsa-2024-2394.md) | Apr 30, 2024 | | Linux | kernel-debug RHEL 9 | 0:5.14.0-427.13.1.el9_4 | [RHSA-2024:2394](https://patchblox.com/security/data/fix/linux/rhsa-2024-2394.md) | Apr 30, 2024 | | Linux | kernel-debug-core RHEL 9 | 0:5.14.0-427.13.1.el9_4 | [RHSA-2024:2394](https://patchblox.com/security/data/fix/linux/rhsa-2024-2394.md) | Apr 30, 2024 | | Linux | kernel-debug-devel RHEL 9 | 0:5.14.0-427.13.1.el9_4 | [RHSA-2024:2394](https://patchblox.com/security/data/fix/linux/rhsa-2024-2394.md) | Apr 30, 2024 | | Linux | kernel-debug-devel-matched RHEL 9 | 0:5.14.0-427.13.1.el9_4 | [RHSA-2024:2394](https://patchblox.com/security/data/fix/linux/rhsa-2024-2394.md) | Apr 30, 2024 | | Linux | kernel-debug-modules RHEL 9 | 0:5.14.0-427.13.1.el9_4 | [RHSA-2024:2394](https://patchblox.com/security/data/fix/linux/rhsa-2024-2394.md) | Apr 30, 2024 | | Linux | kernel-debug-modules-core RHEL 9 | 0:5.14.0-427.13.1.el9_4 | [RHSA-2024:2394](https://patchblox.com/security/data/fix/linux/rhsa-2024-2394.md) | Apr 30, 2024 | | Linux | kernel-debug-modules-extra RHEL 9 | 0:5.14.0-427.13.1.el9_4 | [RHSA-2024:2394](https://patchblox.com/security/data/fix/linux/rhsa-2024-2394.md) | Apr 30, 2024 | | Linux | kernel-debug-uki-virt RHEL 9 | 0:5.14.0-427.13.1.el9_4 | [RHSA-2024:2394](https://patchblox.com/security/data/fix/linux/rhsa-2024-2394.md) | Apr 30, 2024 | | Linux | kernel-devel RHEL 9 | 0:5.14.0-427.13.1.el9_4 | [RHSA-2024:2394](https://patchblox.com/security/data/fix/linux/rhsa-2024-2394.md) | Apr 30, 2024 | | Linux | kernel-devel-matched RHEL 9 | 0:5.14.0-427.13.1.el9_4 | [RHSA-2024:2394](https://patchblox.com/security/data/fix/linux/rhsa-2024-2394.md) | Apr 30, 2024 | | Linux | kernel-doc RHEL 9 | 0:5.14.0-427.13.1.el9_4 | [RHSA-2024:2394](https://patchblox.com/security/data/fix/linux/rhsa-2024-2394.md) | Apr 30, 2024 | | Linux | kernel-modules RHEL 9 | 0:5.14.0-427.13.1.el9_4 | [RHSA-2024:2394](https://patchblox.com/security/data/fix/linux/rhsa-2024-2394.md) | Apr 30, 2024 | | Linux | kernel-modules-core RHEL 9 | 0:5.14.0-427.13.1.el9_4 | [RHSA-2024:2394](https://patchblox.com/security/data/fix/linux/rhsa-2024-2394.md) | Apr 30, 2024 | | Linux | kernel-modules-extra RHEL 9 | 0:5.14.0-427.13.1.el9_4 | [RHSA-2024:2394](https://patchblox.com/security/data/fix/linux/rhsa-2024-2394.md) | Apr 30, 2024 | | Linux | kernel-rt RHEL 9 | 0:5.14.0-427.13.1.el9_4 | [RHSA-2024:2394](https://patchblox.com/security/data/fix/linux/rhsa-2024-2394.md) | Apr 30, 2024 | | Linux | kernel-rt-core RHEL 9 | 0:5.14.0-427.13.1.el9_4 | [RHSA-2024:2394](https://patchblox.com/security/data/fix/linux/rhsa-2024-2394.md) | Apr 30, 2024 | | Linux | kernel-rt-debug RHEL 9 | 0:5.14.0-427.13.1.el9_4 | [RHSA-2024:2394](https://patchblox.com/security/data/fix/linux/rhsa-2024-2394.md) | Apr 30, 2024 | | Linux | kernel-rt-debug-core RHEL 9 | 0:5.14.0-427.13.1.el9_4 | [RHSA-2024:2394](https://patchblox.com/security/data/fix/linux/rhsa-2024-2394.md) | Apr 30, 2024 | | Linux | kernel-rt-debug-devel RHEL 9 | 0:5.14.0-427.13.1.el9_4 | [RHSA-2024:2394](https://patchblox.com/security/data/fix/linux/rhsa-2024-2394.md) | Apr 30, 2024 | | Linux | kernel-rt-debug-kvm RHEL 9 | 0:5.14.0-427.13.1.el9_4 | [RHSA-2024:2394](https://patchblox.com/security/data/fix/linux/rhsa-2024-2394.md) | Apr 30, 2024 | | Linux | kernel-rt-debug-modules RHEL 9 | 0:5.14.0-427.13.1.el9_4 | [RHSA-2024:2394](https://patchblox.com/security/data/fix/linux/rhsa-2024-2394.md) | Apr 30, 2024 | | Linux | kernel-rt-debug-modules-core RHEL 9 | 0:5.14.0-427.13.1.el9_4 | [RHSA-2024:2394](https://patchblox.com/security/data/fix/linux/rhsa-2024-2394.md) | Apr 30, 2024 | | Linux | kernel-rt-debug-modules-extra RHEL 9 | 0:5.14.0-427.13.1.el9_4 | [RHSA-2024:2394](https://patchblox.com/security/data/fix/linux/rhsa-2024-2394.md) | Apr 30, 2024 | | Linux | kernel-rt-devel RHEL 9 | 0:5.14.0-427.13.1.el9_4 | [RHSA-2024:2394](https://patchblox.com/security/data/fix/linux/rhsa-2024-2394.md) | Apr 30, 2024 | | Linux | kernel-rt-kvm RHEL 9 | 0:5.14.0-427.13.1.el9_4 | [RHSA-2024:2394](https://patchblox.com/security/data/fix/linux/rhsa-2024-2394.md) | Apr 30, 2024 | | Linux | kernel-rt-modules RHEL 9 | 0:5.14.0-427.13.1.el9_4 | [RHSA-2024:2394](https://patchblox.com/security/data/fix/linux/rhsa-2024-2394.md) | Apr 30, 2024 | | Linux | kernel-rt-modules-core RHEL 9 | 0:5.14.0-427.13.1.el9_4 | [RHSA-2024:2394](https://patchblox.com/security/data/fix/linux/rhsa-2024-2394.md) | Apr 30, 2024 | | Linux | kernel-rt-modules-extra RHEL 9 | 0:5.14.0-427.13.1.el9_4 | [RHSA-2024:2394](https://patchblox.com/security/data/fix/linux/rhsa-2024-2394.md) | Apr 30, 2024 | | Linux | kernel-tools RHEL 9 | 0:5.14.0-427.13.1.el9_4 | [RHSA-2024:2394](https://patchblox.com/security/data/fix/linux/rhsa-2024-2394.md) | Apr 30, 2024 | | Linux | kernel-tools-libs RHEL 9 | 0:5.14.0-427.13.1.el9_4 | [RHSA-2024:2394](https://patchblox.com/security/data/fix/linux/rhsa-2024-2394.md) | Apr 30, 2024 | | Linux | kernel-tools-libs-devel RHEL 9 | 0:5.14.0-427.13.1.el9_4 | [RHSA-2024:2394](https://patchblox.com/security/data/fix/linux/rhsa-2024-2394.md) | Apr 30, 2024 | | Linux | kernel-uki-virt RHEL 9 | 0:5.14.0-427.13.1.el9_4 | [RHSA-2024:2394](https://patchblox.com/security/data/fix/linux/rhsa-2024-2394.md) | Apr 30, 2024 | | Linux | kernel-zfcpdump RHEL 9 | 0:5.14.0-427.13.1.el9_4 | [RHSA-2024:2394](https://patchblox.com/security/data/fix/linux/rhsa-2024-2394.md) | Apr 30, 2024 | | Linux | kernel-zfcpdump-core RHEL 9 | 0:5.14.0-427.13.1.el9_4 | [RHSA-2024:2394](https://patchblox.com/security/data/fix/linux/rhsa-2024-2394.md) | Apr 30, 2024 | | Linux | kernel-zfcpdump-devel RHEL 9 | 0:5.14.0-427.13.1.el9_4 | [RHSA-2024:2394](https://patchblox.com/security/data/fix/linux/rhsa-2024-2394.md) | Apr 30, 2024 | | Linux | kernel-zfcpdump-devel-matched RHEL 9 | 0:5.14.0-427.13.1.el9_4 | [RHSA-2024:2394](https://patchblox.com/security/data/fix/linux/rhsa-2024-2394.md) | Apr 30, 2024 | | Linux | kernel-zfcpdump-modules RHEL 9 | 0:5.14.0-427.13.1.el9_4 | [RHSA-2024:2394](https://patchblox.com/security/data/fix/linux/rhsa-2024-2394.md) | Apr 30, 2024 | | Linux | kernel-zfcpdump-modules-core RHEL 9 | 0:5.14.0-427.13.1.el9_4 | [RHSA-2024:2394](https://patchblox.com/security/data/fix/linux/rhsa-2024-2394.md) | Apr 30, 2024 | | Linux | kernel-zfcpdump-modules-extra RHEL 9 | 0:5.14.0-427.13.1.el9_4 | [RHSA-2024:2394](https://patchblox.com/security/data/fix/linux/rhsa-2024-2394.md) | Apr 30, 2024 | | Linux | libperf RHEL 9 | 0:5.14.0-427.13.1.el9_4 | [RHSA-2024:2394](https://patchblox.com/security/data/fix/linux/rhsa-2024-2394.md) | Apr 30, 2024 | | Linux | linux Debian 12.15 (bookworm) | 6.0.7-1 | [DEBIAN-CVE-2022-50780](https://patchblox.com/security/data/fix/linux/debian-cve-2022-50780.md) | Dec 24, 2025 | | Linux | linux Debian 13.5 (trixie) | 6.0.7-1 | [DEBIAN-CVE-2022-50780](https://patchblox.com/security/data/fix/linux/debian-cve-2022-50780.md) | Dec 24, 2025 | | Linux | linux Debian 14 | 6.0.7-1 | [DEBIAN-CVE-2022-50780](https://patchblox.com/security/data/fix/linux/debian-cve-2022-50780.md) | Dec 24, 2025 | | Linux | perf RHEL 9 | 0:5.14.0-427.13.1.el9_4 | [RHSA-2024:2394](https://patchblox.com/security/data/fix/linux/rhsa-2024-2394.md) | Apr 30, 2024 | | Linux | python3-perf RHEL 9 | 0:5.14.0-427.13.1.el9_4 | [RHSA-2024:2394](https://patchblox.com/security/data/fix/linux/rhsa-2024-2394.md) | Apr 30, 2024 | | Linux | rtla RHEL 9 | 0:5.14.0-427.13.1.el9_4 | [RHSA-2024:2394](https://patchblox.com/security/data/fix/linux/rhsa-2024-2394.md) | Apr 30, 2024 | | Linux | rv RHEL 9 | 0:5.14.0-427.13.1.el9_4 | [RHSA-2024:2394](https://patchblox.com/security/data/fix/linux/rhsa-2024-2394.md) | Apr 30, 2024 | --- Data as of 2026-11-08T13:06:02Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.