CVE-2022-49110netfilter: conntrack: revisit gc autotuning
Updated under an hour ago ()
Does this affect you?
It affects Linux and 1 other product. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: revisit gc autotuning as of commit 4608fdfc07e1 ("netfilter: conntrack: collect all entries in one cycle") conntrack gc was changed to run every 2 minutes. On systems where conntrack hash table is set to large value, most evictions happen from gc worker rather than the packet path due to hash table distribution. This causes netlink event overflows when events are collected. This change collects average expiry of scanned entries and reschedules to the average remaining value, within 1 to 60 second interval. To avoid event overflows, reschedule after each bucket and add a limit for both run time and number of evictions per run. If more entries have to be evicted, reschedule and restart 1 jiffy into the future.
- CVSS
- 7.5 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Modified
- Record last updated
- Oct 15, 2026
- First seen by InfoSec Signals
- Oct 15, 2026
Affected products
Linux Linux linux:linux (from the name) | 4608fdfc07e116f9fc0895beb40abad7cdb5ee3d builds before 58d52743ae85d28c9335c6034d6ce350b8689951; 4608fdfc07e116f9fc0895beb40abad7cdb5ee3d builds before 7cd361d5e6d986c0d4cafb9ceaa803359048ae15; 4608fdfc07e116f9fc0895beb40abad7cdb5ee3d builds before 592e57591826f3d09c28d755a39ea8e9d13705ad; 4608fdfc07e116f9fc0895beb40abad7cdb5ee3d builds before 2cfadb761d3d0219412fd8150faea60c7e863833; dafc95a1e473a0b857af34ecbb17b8b1c90edd75; 5892f910f401c1facfc410e0b042108f2827a77b; f68ad168e23565ce2a3891fec537cfaf8410d1e6; 7aa03980b21fdc7355e20274a68a69a0b2a45c08; and 4 more ranges | CNA record |
linux linux_kernel linux:linux_kernel | before 5.15.34; from 5.16 before 5.16.20; from 5.17 before 5.17.3 | NVD |
References
- https://git.kernel.org/stable/c/58d52743ae85d28c9335c6034d6ce350b8689951patch
- https://git.kernel.org/stable/c/7cd361d5e6d986c0d4cafb9ceaa803359048ae15patch
- https://git.kernel.org/stable/c/592e57591826f3d09c28d755a39ea8e9d13705adpatch
- https://git.kernel.org/stable/c/2cfadb761d3d0219412fd8150faea60c7e863833patch
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.