CVE-2022-49110 netfilter: conntrack: revisit gc autotuning
A flaw in Linux kernel netfilter conntrack garbage collection can cause netlink event overflows, leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-49110?
CVE-2022-49110 is a high-severity denial of service vulnerability in Linux kernel, published on 26 Feb 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
netfilter: conntrack: revisit gc autotuning
as of commit 4608fdfc07e1 ("netfilter: conntrack: collect all entries in one cycle") conntrack gc was changed to run every 2 minutes.
On systems where conntrack hash table is set to large value, most evictions happen from gc worker rather than the packet path due to hash table distribution.
This causes netlink event overflows when events are collected.
This change collects average expiry of scanned entries and reschedules to the average remaining value, within 1 to 60 second interval.
To avoid event overflows, reschedule after each bucket and add a limit for both run time and number of evictions per run.
If more entries have to be evicted, reschedule and restart 1 jiffy into the future.
Which versions are affected by CVE-2022-49110?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2022-49110?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2022-49110 being exploited?
There is no known exploitation of CVE-2022-49110 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as DEBIAN-CVE-2022-49110, GHSA-pv5x-cgg5-p627, ROOT-OS-DEBIAN-11-CVE-2022-49110, UBUNTU-CVE-2022-49110.