CVE-2022-49561

In the Linux kernel, the following vulnerability has been resolved:

netfilter: conntrack: re-fetch conntrack after insertion

In case the conntrack is clashing, insertion can free skb->_nfct and set skb->_nfct to the already-confirmed entry.

This wasn't found before because the conntrack entry and the extension space used to free'd after an rcu grace period, plus the race needs events enabled to trigger.

This vulnerability is rated as Moderate severity because triggering the underlying race condition requires specific connection tracking clash conditions with event notifications enabled, limiting the blast radius to a denial of service through a system crash without compromising confidentiality or integrity. In Red Hat Enterprise Linux environments, connection tracking is frequently active to support stateful filtering in firewalld or container runtimes. Although the issue can cause kernel instability when handling conflicting connection insertions, it does not allow remote code execution or unauthorized privilege elevation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.