CVE-2022-2586

HighCVSS 7.8/10Known exploited (CISA KEV)Last modified Oct 14, 2026

Description

It was discovered that a nft object or expression could reference a nft set on a different nft table, leading to a use-after-free once that table was deleted.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

No affected versions have been published.

Timeline

Published: Jan 8, 2024
Last modified: Oct 14, 2026
Added to CISA KEV: Jun 26, 2024
NVD status: Analyzed

Related CVEs from 2022

CVE-2022-258609.8Versions of the package simple-git before 3.16.0 are vulnerable to Remote Code Execution (RCE) via the clone(), pull(), push() and listRemot CVE-2022-258627.5This affects the package sds from 0.0.0. The library could be tricked into adding or modifying properties of the Object.prototype by abusing CVE-2022-258639.8The package gatsby-plugin-mdx before 2.14.1, from 3.0.0 and before 3.15.2 are vulnerable to Deserialization of Untrusted Data when passing i CVE-2022-258647.8Uncontrolled search path in some Intel(R) oneMKL software before version 2022.0 may allow an authenticated user to potentially enable escala CVE-2022-258659.8The package workspace-tools before 0.18.4 are vulnerable to Command Injection via git argument injection. When calling the fetchRemoteBranch CVE-2022-258669.8The package czproject/git-php before 4.0.3 are vulnerable to Command Injection via git argument injection. When calling the isRemoteUrlReada CVE-2022-258677.5The package io.socket:socket.io-client before 2.0.1 are vulnerable to NULL Pointer Dereference when parsing a packet with with invalid paylo CVE-2022-258696.1All versions of the package angular; all versions of the package angularjs.core; all versions of the package angularjs are vulnerable to Cro CVE-2022-25879.8Out of bounds write in Chrome OS Audio Server in Google Chrome on Chrome OS prior to 102.0.5005.125 allowed a remote attacker to potentially CVE-2022-258717.5All versions of package querymen are vulnerable to Prototype Pollution if the parameters of exported function handler(type, name, fn) can be CVE-2022-258725.3All versions of package fast-string-search are vulnerable to Out-of-bounds Read due to incorrect memory freeing and length calculation for a CVE-2022-258735.4The package vuetify from 2.0.0-beta.4 and before 2.6.10 are vulnerable to Cross-site Scripting (XSS) due to improper input sanitization in t