CriticalCVE-2022-2586

Linux Kernel Use-After-Free Vulnerability (CVE-2022-2586)

Published 08.01.2024Last modified 14.10.2026In CISA KEV since 26.06.2024Sources: SUSE, CVE.org, Red Hat, Debian, pwn.watch, Siemens ProductCERT

Actively exploited

What is affected, what to do

It was discovered that a nft object or expression could reference a nft set on a different nft table, leading to a use-after-free once that table was deleted.

The vulnerability is being actively exploited; treat it as a priority. Update The Linux Kernel Organization Linux to version 4.14.316, The Linux Kernel Organization Linux to version 4.19.256, The Linux Kernel Organization Linux to version 5.4.211. Immediate actions, mitigation and detection rules are in the runbook below.

Affected: The Linux Kernel Organization Linux lt 3.16..4.14.316
The Linux Kernel Organization Linux lt 4.15..4.19.256
The Linux Kernel Organization Linux lt 4.20..5.4.211
The Linux Kernel Organization Linux lt 5.5..5.10.137
The Linux Kernel Organization Linux lt 5.11..5.15.61
The Linux Kernel Organization Linux lt 5.16..5.18.18
The Linux Kernel Organization Linux lt 5.19..5.19.2
Fixed in: The Linux Kernel Organization Linux 4.14.316
The Linux Kernel Organization Linux 4.19.256
The Linux Kernel Organization Linux 5.4.211
The Linux Kernel Organization Linux 5.10.137
The Linux Kernel Organization Linux 5.15.61
The Linux Kernel Organization Linux 5.18.18
The Linux Kernel Organization Linux 5.19.2

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

7.8

Priority

XIEM Effective CVSS: highest available CVSS rating from NVD and vendor data.

Source: NVD, CVSS v3

5.3

CVSS v3

Severity Medium on the scale from 0 to 10.

Source: SUSE, CVE.org, Red Hat, Debian, pwn.watch, Siemens ProductCERT

10.2 %

EPSS score

Elevated — model estimates 10-50% exploitation likelihood.

Source: FIRST EPSS, percentile 95.7

Show all metrics

Severity: Critical
Priority (0–325) The priority score is a consolidated metric that condenses several individual signals into a single, action-guiding ranking: technical severity (CVSS), exploitation likelihood (EPSS), known-exploited status (KEV) and the context of the affected asset. The aim is to answer the only truly important question in vulnerability management: what first? Read in glossary: 203.92 Methodology
Exploit maturity An exploit is code or a technique that specifically uses a concrete vulnerability to force unintended behaviour — such as executing code or escalating privileges. It is the tool that turns a theoretical flaw into a practical attack. Read in glossary: actively exploited
XIEM Effective CVSS XIEM® is the tiered managed-security operating model from NEOSEC and a registered trademark of NEOSEC GmbH. It extends classic SIEM — the central collection, normalisation and correlation of security-relevant events — with endpoint forensics, network visibility and deception technology, and consolidates them into three building tiers: Sentry, Orchestrate and Command. Read in glossary: 7.8 Methodology
CVSS v3 CVSS is the globally established, open standard for assessing the technical severity of a vulnerability on a scale from 0 to 10. It describes how easily a flaw can be exploited and what damage it can cause — but not how likely its actual exploitation is. CVSS and the complementary EPSS deliberately answer different questions. Read in glossary: 5.3
EPSS score The EPSS score is the absolute model output for an individual vulnerability: the estimated probability of real-world exploitation within the next 30 days, expressed as a value between 0 and 1 (i.e. 0 % to 100 %). A score of 0.42 means „the model estimates a 42 % chance of real-world exploitation within 30 days“. Read in glossary: 10.2 %; Elevated — model estimates 10-50% exploitation likelihood.
EPSS percentile The EPSS percentile is the relative position of a vulnerability within all EPSS-scored CVEs, expressed as a value between 0 and 1. A percentile of 0.90 means „this CVE has a higher EPSS score than 90 % of all other scored CVEs“. Unlike the EPSS score, it is not a probability — but a positioning within a ranking. Read in glossary: 95.7; Critical — this CVE ranks in the top fifth of all CVEs scored today (rank ≥ 80%).
KEV status The KEV catalogue is a list maintained by the US authority CISA of vulnerabilities for which active exploitation in the wild has been confirmed. It answers not the question „how severe?“ but „is it already being attacked?“ — thereby sharply prioritising patching. Read in glossary: Actively exploited
Published: 08.01.2024
In CISA KEV since The KEV catalogue is a list maintained by the US authority CISA of vulnerabilities for which active exploitation in the wild has been confirmed. It answers not the question „how severe?“ but „is it already being attacked?“ — thereby sharply prioritising patching. Read in glossary: 26.06.2024
CWE CWE is a catalogue of typical weakness types in software and hardware — such as flawed input validation, unsafe memory handling or poor authentication. Where a CVE names a concrete vulnerability in a concrete product, a CWE describes the underlying class of defect. Read in glossary: CWE-416

Response and mitigation

Why act now?

Prioritisation rationale

This is a reliable local privilege escalation to root. It needs only a low-privileged account and no user interaction, and public exploit code has been available for some time. Attackers chain it after initial access through webshells, compromised SSH credentials or container workloads to gain persistence and harvest credentials. CISA does not flag ransomware use, but the likelihood of exploitation is still rated high relative to most CVEs. Rank multi-user and multi-tenant systems, Kubernetes nodes, CI runners and internet-facing Linux servers with unprivileged user namespaces enabled at the top. Single-user hosts without third-party shell access can follow the regular patch cycle once the sysctl mitigation is in place.

01
Runbook step 1
Immediate response (0-24 h)
- Inventory kernel versions: Collect uname -r from every Linux host (Ansible/Salt/osquery) and compare against the fixed upstream releases: 4.14.316, 4.19.256, 5.4.211, 5.10.137, 5.15.61, 5.18.18 or 5.19.2. Distribution kernels (RHEL, SUSE, Debian, Ubuntu) use their own version strings. Look up the fixed build in the vendor advisory (USN, RHSA, DSA, SUSE-SU).
- Install the patched kernel and reboot: A package update without a reboot leaves the host exposed. Patch multi-user systems first: jump hosts, CI/CD runners, container hosts, shared hosting and terminal servers. Check with the vendor whether Canonical Livepatch, kpatch or kGraft cover this fix.
- Treat Ubuntu 14.04 separately: It is listed as affected and only receives security updates through ESM/Ubuntu Pro. Without ESM coverage, treat it as unpatchable and isolate or retire it.
- Disable unprivileged user namespaces now: Exploitation requires CAP_NET_ADMIN to create nf_tables objects, which an attacker normally obtains through their own user namespace. Run sysctl -w kernel.unprivileged_userns_clone=0 (Debian/Ubuntu) or sysctl -w user.max_user_namespaces=0 (RHEL/generic), and persist the setting in /etc/sysctl.d/. Test first, because rootless Podman/Docker, Flatpak and the Chromium sandbox depend on it.
- Review local accounts: Lock unnecessary interactive shell accounts on exposed hosts and revoke SSH keys belonging to service or stale accounts.
02
Runbook step 2
Mitigation layers
- Kernel module hardening: On hosts that don't use nftables, block auto-loading with echo "install nf_tables /bin/false" > /etc/modprobe.d/disable-nftables.conf. First verify that iptables-nft or firewalld isn't using nf_tables as its backend, because in that case the module must stay available. Check current state with lsmod | grep nf_tables.
- Container isolation: Enforce the RuntimeDefault seccomp profile in Kubernetes (Pod Security Admission "restricted"). Docker's default profile blocks unshare/clone with CLONE_NEWUSER unless the process holds CAP_SYS_ADMIN. Deny privileged: true and CAP_NET_ADMIN without explicit approval.
- Ubuntu 23.10 and later: Set kernel.apparmor_restrict_unprivileged_userns=1 so that processes in a new user namespace only receive full capabilities if they run under an explicit AppArmor profile.
- IAM/least privilege: Keep local shell access to the minimum required. Run web application and service accounts with nologin, and mount /tmp, /dev/shm and /var/tmp with noexec.
- Network segmentation: This is a local bug, typically chained after initial access. Place unpatched hosts in a dedicated VLAN reachable only via bastion, which limits lateral movement once root is obtained.
03
Runbook step 3
Detection rules
- auditd – user namespace creation: -a always,exit -F arch=b64 -S unshare -F a0&0x10000000 -F auid>=1000 -F auid!=4294967295 -k userns_create. Investigate hits from non-admin users outside known applications (browsers, rootless containers).
- auditd – netfilter netlink sockets: -a always,exit -F arch=b64 -S socket -F a0=16 -F a2=12 -F auid>=1000 -k nfnetlink_user (AF_NETLINK=16, NETLINK_NETFILTER=12). Both userns_create and nfnetlink_user firing in the same process tree is a strong signal.
- Process ancestry (EDR/Sysmon for Linux EID 1): A root process (e.g. /bin/sh, bash) whose parent ran under an unprivileged UID and is not sudo, su or pkexec. Sigma shape: ParentUser != root AND User = root AND ParentImage NOT IN (sudo, su, pkexec, polkit).
- Kernel log (journald/syslog): general protection fault, BUG: KASAN: use-after-free or Oops with nf_tables/nft_ frames in the call trace indicate failed exploit attempts. SPL example: index=linux sourcetype=kern* ("nf_tables" OR "nft_") ("Oops" OR "use-after-free" OR "general protection").
- File telemetry: Newly written ELF binaries in /tmp, /dev/shm or home directories that are executed shortly afterwards (Sysmon for Linux EID 11 followed by EID 1). Enable the Falco rule "Execution from /dev/shm".

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2 NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management. Read in glossary: Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).
CRA The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates. Read in glossary: Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.
ISO/IEC 27001 ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security. Read in glossary: Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

It was discovered that a nft object or expression could reference a nft set on a different nft table, leading to a use-after-free once that table was deleted.

Source: suse_csaf, cvelistv5, redhat_csaf, Debian Security Advisories, pwn.watch, NVD (NIST), CISA KEV Catalog, CVE.org (MITRE), siemens_advisory

Affected products

The following versions are affected. Older releases of the same product line are also vulnerable unless stated otherwise.

Affected products
		Affected versions	Fixed in
The Linux Kernel Organization	linux	`5.16 – < 5.18.18` `4.20 – < 5.4.211` `5.11 – < 5.15.61` `5.19 – < 5.19.2` `3.16 – < 4.14.316` `4.15 – < 4.19.256` `5.5 – < 5.10.137`	`5.18.18` `5.4.211` `5.15.61` `5.19.2` `4.14.316` `4.19.256` `5.10.137`

Vendors and products

Affected operating systems

Affected operating systems

Linux	debian	linux	`bullseye`
Linux	linux	linux_kernel	`6.0`
Linux	linux	linux_kernel	—
Linux	canonical	ubuntu_linux	`14.04`
Linux	canonical	ubuntu_linux	`16.04`
Linux	canonical	ubuntu_linux	`18.04`
Linux	canonical	ubuntu_linux	`20.04`
Linux	canonical	ubuntu_linux	`22.04`
Other	siemens	simatic_s7-1500_tm_mfp_firmware	—
Other	siemens	sinec_os	—

Weakness classes (CWE)

CWE-416Use After Free
Variant
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Entry at MITRE CWE-416

Public exploit references

Publicly reported proof-of-concepts, exploit modules and detection templates for this vulnerability. NEOSEC links to the original sources only and does not provide any exploit code.

Public exploit references

CISA KEV Catalog	CISA Known Exploited Vulnerability (opens in a new tab)cisa.gov	actively exploited	26.06.2024

References & sources

ubuntu.comsecurity/notices/USN-5564-1Third-party advisory
ubuntu.comsecurity/notices/USN-5560-2Third-party advisory
ubuntu.comsecurity/notices/USN-5582-1Third-party advisory
ubuntu.comsecurity/notices/USN-5567-1Third-party advisory
ubuntu.comsecurity/notices/USN-5560-1Third-party advisory
ubuntu.comsecurity/notices/USN-5566-1Third-party advisory
openwall.comlists/oss-security/2022/08/09/5Issue tracking
ubuntu.comsecurity/notices/USN-5565-1Third-party advisory
zerodayinitiative.comadvisories/ZDI-22-1118Issue tracking
lore.kernel.orgnetfilter-devel/20220809170148.164591-1-cascardo@canonical.com/TIssue tracking
ubuntu.comsecurity/notices/USN-5562-1Third-party advisory
ubuntu.comsecurity/notices/USN-5557-1Third-party advisory
CVE.org (MITRE)cgi-bin/cvename.cgi?name=CVE-2022-2586Issue tracking
cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2022-2586government-resource
vicarius.iovsociety/posts/use-after-free-vulnerability-linked-chain-betwee…
Siemens ProductCERTproductcert/html/ssa-794697.html
Siemens ProductCERTproductcert/html/ssa-806742.html
pwn.watchpwn.watch: Linux Kernel Use-After-Freepwn-watch
seclists.orgLinux advisory: CVE-2022-2586pwn-watch
NVD (NIST)NVD: CVE-2022-2586pwn-watch

Changes to this CVE

Who changed this CVE and when: NVD (analysis, affected products, CVSS), the CVE publisher (CNA) and additional providers such as CISA (ADP).

14.10.2026NVD analysis modifiedNVD

Newly listed as affected:

Siemens SIMATIC S7-1500 TM MFP Firmware (before 1.1)
Siemens SINEC OS (before 2.4)

New references:

Show 4 original changes

Individual changes of this event as published by NVD
Type	Action	Before	After
Product configuration	added	—	AND OR cpe:2.3:o:siemens:simatic_s7-1500_tm_mfp_firmware::::::::* versions up to (excluding) 1.1 OR cpe:2.3:h:siemens:simatic_s7-1500_tm_mfp:-:::::::*
Product configuration	added	—	AND OR cpe:2.3:o:siemens:sinec_os::::::::* versions up to (excluding) 2.4 OR cpe:2.3:h:siemens:scalance_xch328:-:::::::* cpe:2.3:h:siemens:scalance_xcm324:-:::::::* cpe:2.3:h:siemens:scalance_xcm328:-:::::::* cpe:2.3:h:siemens:scalance_xcm332:-:::::::* cpe:2.3:h:siemens:scalance_xrh334:-:::::::* cpe:2.3:h:siemens:scalance_xrm334:-:::::::*
Reference type	added	—	siemens-SADP: https://cert-portal.siemens.com/productcert/html/ssa-794697.html Types: Third Party Advisory
Reference type	added	—	siemens-SADP: https://cert-portal.siemens.com/productcert/html/ssa-806742.html Types: Third Party Advisory

Source identifier: nvd@nist.gov

14.10.2026Record modifiedubuntu.com

New references:

and 8 more references

Show 39 original changes

Individual changes of this event as published by NVD
Type	Action	Before	After
Reference	added	—	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2586
Reference	added	—	https://lore.kernel.org/netfilter-devel/20220809170148.164591-1-cascardo@canonical.com/T/#t
Reference	added	—	https://ubuntu.com/security/notices/USN-5557-1
Reference	added	—	https://ubuntu.com/security/notices/USN-5560-1
Reference	added	—	https://ubuntu.com/security/notices/USN-5560-2
Reference	added	—	https://ubuntu.com/security/notices/USN-5562-1
Reference	added	—	https://ubuntu.com/security/notices/USN-5564-1
Reference	added	—	https://ubuntu.com/security/notices/USN-5565-1
Reference	added	—	https://ubuntu.com/security/notices/USN-5566-1
Reference	added	—	https://ubuntu.com/security/notices/USN-5567-1
Reference	added	—	https://ubuntu.com/security/notices/USN-5582-1
Reference	added	—	https://www.openwall.com/lists/oss-security/2022/08/09/5
Reference	added	—	https://www.zerodayinitiative.com/advisories/ZDI-22-1118/
Reference	removed	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2586	—
Reference	removed	https://lore.kernel.org/netfilter-devel/20220809170148.164591-1-cascardo@canonical.com/T/#t	—
Reference	removed	https://ubuntu.com/security/notices/USN-5557-1	—
Reference	removed	https://ubuntu.com/security/notices/USN-5560-1	—
Reference	removed	https://ubuntu.com/security/notices/USN-5560-2	—
Reference	removed	https://ubuntu.com/security/notices/USN-5562-1	—
Reference	removed	https://ubuntu.com/security/notices/USN-5564-1	—
Reference	removed	https://ubuntu.com/security/notices/USN-5565-1	—
Reference	removed	https://ubuntu.com/security/notices/USN-5566-1	—
Reference	removed	https://ubuntu.com/security/notices/USN-5567-1	—
Reference	removed	https://ubuntu.com/security/notices/USN-5582-1	—
Reference	removed	https://www.openwall.com/lists/oss-security/2022/08/09/5	—
Reference	removed	https://www.zerodayinitiative.com/advisories/ZDI-22-1118/	—
Reference type	removed	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2586 Types: Third Party Advisory	—
Reference type	removed	https://lore.kernel.org/netfilter-devel/20220809170148.164591-1-cascardo@canonical.com/T/#t Types: Mailing List, Patch	—
Reference type	removed	https://ubuntu.com/security/notices/USN-5557-1 Types: Third Party Advisory	—
Reference type	removed	https://ubuntu.com/security/notices/USN-5560-1 Types: Third Party Advisory	—
Reference type	removed	https://ubuntu.com/security/notices/USN-5560-2 Types: Third Party Advisory	—
Reference type	removed	https://ubuntu.com/security/notices/USN-5562-1 Types: Third Party Advisory	—
Reference type	removed	https://ubuntu.com/security/notices/USN-5564-1 Types: Third Party Advisory	—
Reference type	removed	https://ubuntu.com/security/notices/USN-5565-1 Types: Third Party Advisory	—
Reference type	removed	https://ubuntu.com/security/notices/USN-5566-1 Types: Third Party Advisory	—
Reference type	removed	https://ubuntu.com/security/notices/USN-5567-1 Types: Third Party Advisory	—
Reference type	removed	https://ubuntu.com/security/notices/USN-5582-1 Types: Third Party Advisory	—
Reference type	removed	https://www.openwall.com/lists/oss-security/2022/08/09/5 Types: Mailing List	—
Reference type	removed	https://www.zerodayinitiative.com/advisories/ZDI-22-1118/ Types: Third Party Advisory, VDB Entry	—

Source identifier: security@ubuntu.com

14.10.2026Record modifiedCISA ADP

New references:

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-2586

Show 3 original changes

Individual changes of this event as published by NVD
Type	Action	Before	After
Reference	added	—	https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-2586
Reference	removed	https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-2586	—
Reference type	removed	https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-2586 Types: US Government Resource	—

Source identifier: 134c704f-9b21-4f2e-91b3-4a467353bcc0

14.10.2026Record modifiedCVE Program

New references:

and 8 more references

Show 42 original changes

Individual changes of this event as published by NVD
Type	Action	Before	After
Reference	added	—	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2586
Reference	added	—	https://lore.kernel.org/netfilter-devel/20220809170148.164591-1-cascardo@canonical.com/T/#t
Reference	added	—	https://ubuntu.com/security/notices/USN-5557-1
Reference	added	—	https://ubuntu.com/security/notices/USN-5560-1
Reference	added	—	https://ubuntu.com/security/notices/USN-5560-2
Reference	added	—	https://ubuntu.com/security/notices/USN-5562-1
Reference	added	—	https://ubuntu.com/security/notices/USN-5564-1
Reference	added	—	https://ubuntu.com/security/notices/USN-5565-1
Reference	added	—	https://ubuntu.com/security/notices/USN-5566-1
Reference	added	—	https://ubuntu.com/security/notices/USN-5567-1
Reference	added	—	https://ubuntu.com/security/notices/USN-5582-1
Reference	added	—	https://www.openwall.com/lists/oss-security/2022/08/09/5
Reference	added	—	https://www.vicarius.io/vsociety/posts/use-after-free-vulnerability-linked-chain-between-nft-tables-cve-2022-2586
Reference	added	—	https://www.zerodayinitiative.com/advisories/ZDI-22-1118/
Reference	removed	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2586	—
Reference	removed	https://lore.kernel.org/netfilter-devel/20220809170148.164591-1-cascardo@canonical.com/T/#t	—
Reference	removed	https://ubuntu.com/security/notices/USN-5557-1	—
Reference	removed	https://ubuntu.com/security/notices/USN-5560-1	—
Reference	removed	https://ubuntu.com/security/notices/USN-5560-2	—
Reference	removed	https://ubuntu.com/security/notices/USN-5562-1	—
Reference	removed	https://ubuntu.com/security/notices/USN-5564-1	—
Reference	removed	https://ubuntu.com/security/notices/USN-5565-1	—
Reference	removed	https://ubuntu.com/security/notices/USN-5566-1	—
Reference	removed	https://ubuntu.com/security/notices/USN-5567-1	—
Reference	removed	https://ubuntu.com/security/notices/USN-5582-1	—
Reference	removed	https://www.openwall.com/lists/oss-security/2022/08/09/5	—
Reference	removed	https://www.vicarius.io/vsociety/posts/use-after-free-vulnerability-linked-chain-between-nft-tables-cve-2022-2586	—
Reference	removed	https://www.zerodayinitiative.com/advisories/ZDI-22-1118/	—
Reference type	removed	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2586 Types: Third Party Advisory	—
Reference type	removed	https://lore.kernel.org/netfilter-devel/20220809170148.164591-1-cascardo@canonical.com/T/#t Types: Mailing List, Patch	—
Reference type	removed	https://ubuntu.com/security/notices/USN-5557-1 Types: Third Party Advisory	—
Reference type	removed	https://ubuntu.com/security/notices/USN-5560-1 Types: Third Party Advisory	—
Reference type	removed	https://ubuntu.com/security/notices/USN-5560-2 Types: Third Party Advisory	—
Reference type	removed	https://ubuntu.com/security/notices/USN-5562-1 Types: Third Party Advisory	—
Reference type	removed	https://ubuntu.com/security/notices/USN-5564-1 Types: Third Party Advisory	—
Reference type	removed	https://ubuntu.com/security/notices/USN-5565-1 Types: Third Party Advisory	—
Reference type	removed	https://ubuntu.com/security/notices/USN-5566-1 Types: Third Party Advisory	—
Reference type	removed	https://ubuntu.com/security/notices/USN-5567-1 Types: Third Party Advisory	—
Reference type	removed	https://ubuntu.com/security/notices/USN-5582-1 Types: Third Party Advisory	—
Reference type	removed	https://www.openwall.com/lists/oss-security/2022/08/09/5 Types: Mailing List	—
Reference type	removed	https://www.vicarius.io/vsociety/posts/use-after-free-vulnerability-linked-chain-between-nft-tables-cve-2022-2586 Types: Exploit, Third Party Advisory	—
Reference type	removed	https://www.zerodayinitiative.com/advisories/ZDI-22-1118/ Types: Third Party Advisory, VDB Entry	—

Source identifier: af854a3a-2127-422b-91ae-364da2661108

14.10.2026Record modifiedSiemens ADP

New references:

Show 3 original changes

Individual changes of this event as published by NVD
Type	Action	Before	After
Affected versions (publisher)	added	—	New affected value received. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2022/2xxx/CVE-2022-2586.json">CVE-2022-2586</a>
Reference	added	—	https://cert-portal.siemens.com/productcert/html/ssa-794697.html
Reference	added	—	https://cert-portal.siemens.com/productcert/html/ssa-806742.html

Source identifier: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e

Show one older change

20.08.2026Record modifiedubuntu.com
1 individual change: Affected versions (publisher)
Show the original change
Individual changes of this event as published by NVD
Type Action Before After
Affected versions (publisher) changed
linux
linux
Source identifier: security@ubuntu.com

Individual changes of this event as published by NVD
Type	Action	Before	After
Affected versions (publisher)	changed	linux	linux

Embed badge

Show the severity and KEV status of this vulnerability on your site – with a link back here. The image is updated hourly.

<a href="https://intel.neosec.eu/en/cve/CVE-2022-2586"><img src="https://intel.neosec.eu/badge/cve/CVE-2022-2586.svg?lang=en" alt="CVE-2022-2586 – NEOSEC Intel" height="20"></a>

What is affected, what to do

Metrics

Response and mitigation

Prioritisation rationale

Immediate response (0-24 h)

Mitigation layers

Detection rules

Detection rules

Classification under NIS2 and CRA

Description

Affected products

Vendors and products

Affected operating systems

Weakness classes (CWE)

Public exploit references

References & sources

Changes to this CVE