CVE-2022-3586 is a use-after-free vulnerability in the Linux kernel's networking code, specifically affecting the sch_sfb enqueue function, impacting Debian and other Linux distributions. This flaw allows a local, unprivileged user to trigger a system crash, leading to a denial of service. With a CVSS score of 5.5 (Medium), it requires local access and has low attack complexity. There is no evidence of active exploitation, public exploit code, or significant community discussion, and it is not listed in CISA's KEV catalog.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 2.6.39, <= 5.19CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | ||
6.0CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:6.0:rc1:*:*:*:*:*:* | ||
6.0CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:6.0:rc2:*:*:*:*:*:* | ||
6.0CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:6.0:rc3:*:*:*:*:*:* | ||
6.0CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:6.0:rc4:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
A flaw was found in the Linux kernel’s networking code. A use-after-free was found in the way the sch_sfb enqueue function used the socket buffer (SKB) cb field after the same SKB had been enqueued (and freed) into a child qdisc. This flaw allows a local unprivileged user to crash the system causing a denial of service.
Oct 11, 2022kernel: net scheduler use-after-free information disclosure vulnerability
Aug 31, 2022