{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/nf_tables_api.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "1ffe7100411a8b9015115ce124cd6c9c9da6f8e3",
              "status": "affected",
              "version": "6001a930ce0378b62210d4f83583fc88a903d89d",
              "versionType": "git"
            },
            {
              "lessThan": "e40b7c44d19e327ad8b49a491ef1fa8dcc4566e0",
              "status": "affected",
              "version": "6001a930ce0378b62210d4f83583fc88a903d89d",
              "versionType": "git"
            },
            {
              "lessThan": "d4bc8271db21ea9f1c86a1ca4d64999f184d4aae",
              "status": "affected",
              "version": "6001a930ce0378b62210d4f83583fc88a903d89d",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/nf_tables_api.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.12"
            },
            {
              "lessThan": "5.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.78",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.0.*",
              "status": "unaffected",
              "version": "6.0.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.78",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0.8",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: netlink notifier might race to release objects\n\ncommit release path is invoked via call_rcu and it runs lockless to\nrelease the objects after rcu grace period. The netlink notifier handler\nmight win race to remove objects that the transaction context is still\nreferencing from the commit release path.\n\nCall rcu_barrier() to ensure pending rcu callbacks run to completion\nif the list of transactions to be destroyed is not empty."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-04T08:48:43.498Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/1ffe7100411a8b9015115ce124cd6c9c9da6f8e3"
        },
        {
          "url": "https://git.kernel.org/stable/c/e40b7c44d19e327ad8b49a491ef1fa8dcc4566e0"
        },
        {
          "url": "https://git.kernel.org/stable/c/d4bc8271db21ea9f1c86a1ca4d64999f184d4aae"
        }
      ],
      "title": "netfilter: nf_tables: netlink notifier might race to release objects",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-49920",
    "datePublished": "2025-05-01T14:10:59.436Z",
    "dateReserved": "2025-05-01T14:05:17.252Z",
    "dateUpdated": "2025-05-04T08:48:43.498Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-49920\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-05-01T15:16:17.517\",\"lastModified\":\"2025-05-02T13:52:51.693\",\"vulnStatus\":\"Undergoing Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnetfilter: nf_tables: netlink notifier might race to release objects\\n\\ncommit release path is invoked via call_rcu and it runs lockless to\\nrelease the objects after rcu grace period. The netlink notifier handler\\nmight win race to remove objects that the transaction context is still\\nreferencing from the commit release path.\\n\\nCall rcu_barrier() to ensure pending rcu callbacks run to completion\\nif the list of transactions to be destroyed is not empty.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: netfilter: nf_tables: el notificador netlink podr\u00eda acelerar la liberaci\u00f3n de objetos. La ruta de liberaci\u00f3n de confirmaci\u00f3n se invoca mediante call_rcu y se ejecuta sin bloqueo para liberar los objetos despu\u00e9s del per\u00edodo de gracia de rcu. El controlador del notificador netlink podr\u00eda ganar la ejecuci\u00f3n para eliminar objetos de la ruta de liberaci\u00f3n de confirmaci\u00f3n a los que el contexto de la transacci\u00f3n a\u00fan hace referencia. Se debe llamar a rcu_barrier() para garantizar que las devoluciones de llamada rcu pendientes se ejecuten por completo si la lista de transacciones a destruir no est\u00e1 vac\u00eda.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/1ffe7100411a8b9015115ce124cd6c9c9da6f8e3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/d4bc8271db21ea9f1c86a1ca4d64999f184d4aae\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/e40b7c44d19e327ad8b49a491ef1fa8dcc4566e0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}