CVE-2022-49698 netfilter: use get_random_u32 instead of prandom
A race condition in the Linux kernel netfilter module can cause a kernel bug and potential denial of service when using random number generation.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-49698?
CVE-2022-49698 is a high-severity vulnerability in Linux kernel, published on 26 Feb 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
netfilter: use get_random_u32 instead of prandom
bh might occur while updating per-cpu rnd_state from user context, ie. local_out path.
BUG: using smp_processor_id() in preemptible [00000000] code: nginx/2725 caller is nft_ng_random_eval+0x24/0x54 [nft_numgen] Call Trace: check_preemption_disabled+0xde/0xe0 nft_ng_random_eval+0x24/0x54 [nft_numgen]
Use the random driver instead, this also avoids need for local prandom state. Moreover, prandom now uses the random driver since d4150779e60f ("random32: use real rng for non-deterministic randomness").
Based on earlier patch from Pablo Neira.
Which versions are affected by CVE-2022-49698?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2022-49698?
Apply the vendor's patch.
Is CVE-2022-49698 being exploited?
There is no known exploitation of CVE-2022-49698 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as DEBIAN-CVE-2022-49698, GHSA-crf3-5v2r-wq3r, UBUNTU-CVE-2022-49698.