GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2022-49911 (GCVE-0-2022-49911)

Vulnerability from cvelistv5 – Published: 2025-05-01 14:10 – Updated: 2026-05-11 19:09
VLAI
Title
netfilter: ipset: enforce documented limit to prevent allocating huge memory
Summary
In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: enforce documented limit to prevent allocating huge memory Daniel Xu reported that the hash:net,iface type of the ipset subsystem does not limit adding the same network with different interfaces to a set, which can lead to huge memory usage or allocation failure. The quick reproducer is $ ipset create ACL.IN.ALL_PERMIT hash:net,iface hashsize 1048576 timeout 0 $ for i in $(seq 0 100); do /sbin/ipset add ACL.IN.ALL_PERMIT 0.0.0.0/0,kaf_$i timeout 0 -exist; done The backtrace when vmalloc fails: [Tue Oct 25 00:13:08 2022] ipset: vmalloc error: size 1073741848, exceeds total pages <...> [Tue Oct 25 00:13:08 2022] Call Trace: [Tue Oct 25 00:13:08 2022] <TASK> [Tue Oct 25 00:13:08 2022] dump_stack_lvl+0x48/0x60 [Tue Oct 25 00:13:08 2022] warn_alloc+0x155/0x180 [Tue Oct 25 00:13:08 2022] __vmalloc_node_range+0x72a/0x760 [Tue Oct 25 00:13:08 2022] ? hash_netiface4_add+0x7c0/0xb20 [Tue Oct 25 00:13:08 2022] ? __kmalloc_large_node+0x4a/0x90 [Tue Oct 25 00:13:08 2022] kvmalloc_node+0xa6/0xd0 [Tue Oct 25 00:13:08 2022] ? hash_netiface4_resize+0x99/0x710 <...> The fix is to enforce the limit documented in the ipset(8) manpage: > The internal restriction of the hash:net,iface set type is that the same > network prefix cannot be stored with more than 64 different interfaces > in a single set.
Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: ccf0a4b7fc688561428290265e4effde41446668 , < 42d20d5e24575c9afa2d66d9a51e7386db9514f5 (git)
Affected: ccf0a4b7fc688561428290265e4effde41446668 , < a37ef32fe5956fe9248df68f6a61997845ba047e (git)
Affected: ccf0a4b7fc688561428290265e4effde41446668 , < 510841da1fcc16f702440ab58ef0b4d82a9056b7 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.11
Unaffected: 0 , < 5.11 (semver)
Unaffected: 5.15.78 , ≤ 5.15.* (semver)
Unaffected: 6.0.8 , ≤ 6.0.* (semver)
Unaffected: 6.1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/ipset/ip_set_hash_gen.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "42d20d5e24575c9afa2d66d9a51e7386db9514f5",
              "status": "affected",
              "version": "ccf0a4b7fc688561428290265e4effde41446668",
              "versionType": "git"
            },
            {
              "lessThan": "a37ef32fe5956fe9248df68f6a61997845ba047e",
              "status": "affected",
              "version": "ccf0a4b7fc688561428290265e4effde41446668",
              "versionType": "git"
            },
            {
              "lessThan": "510841da1fcc16f702440ab58ef0b4d82a9056b7",
              "status": "affected",
              "version": "ccf0a4b7fc688561428290265e4effde41446668",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/ipset/ip_set_hash_gen.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.11"
            },
            {
              "lessThan": "5.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.78",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.0.*",
              "status": "unaffected",
              "version": "6.0.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.78",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0.8",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: ipset: enforce documented limit to prevent allocating huge memory\n\nDaniel Xu reported that the hash:net,iface type of the ipset subsystem does\nnot limit adding the same network with different interfaces to a set, which\ncan lead to huge memory usage or allocation failure.\n\nThe quick reproducer is\n\n$ ipset create ACL.IN.ALL_PERMIT hash:net,iface hashsize 1048576 timeout 0\n$ for i in $(seq 0 100); do /sbin/ipset add ACL.IN.ALL_PERMIT 0.0.0.0/0,kaf_$i timeout 0 -exist; done\n\nThe backtrace when vmalloc fails:\n\n        [Tue Oct 25 00:13:08 2022] ipset: vmalloc error: size 1073741848, exceeds total pages\n        \u003c...\u003e\n        [Tue Oct 25 00:13:08 2022] Call Trace:\n        [Tue Oct 25 00:13:08 2022]  \u003cTASK\u003e\n        [Tue Oct 25 00:13:08 2022]  dump_stack_lvl+0x48/0x60\n        [Tue Oct 25 00:13:08 2022]  warn_alloc+0x155/0x180\n        [Tue Oct 25 00:13:08 2022]  __vmalloc_node_range+0x72a/0x760\n        [Tue Oct 25 00:13:08 2022]  ? hash_netiface4_add+0x7c0/0xb20\n        [Tue Oct 25 00:13:08 2022]  ? __kmalloc_large_node+0x4a/0x90\n        [Tue Oct 25 00:13:08 2022]  kvmalloc_node+0xa6/0xd0\n        [Tue Oct 25 00:13:08 2022]  ? hash_netiface4_resize+0x99/0x710\n        \u003c...\u003e\n\nThe fix is to enforce the limit documented in the ipset(8) manpage:\n\n\u003e  The internal restriction of the hash:net,iface set type is that the same\n\u003e  network prefix cannot be stored with more than 64 different interfaces\n\u003e  in a single set."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T19:09:05.818Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/42d20d5e24575c9afa2d66d9a51e7386db9514f5"
        },
        {
          "url": "https://git.kernel.org/stable/c/a37ef32fe5956fe9248df68f6a61997845ba047e"
        },
        {
          "url": "https://git.kernel.org/stable/c/510841da1fcc16f702440ab58ef0b4d82a9056b7"
        }
      ],
      "title": "netfilter: ipset: enforce documented limit to prevent allocating huge memory",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-49911",
    "datePublished": "2025-05-01T14:10:53.631Z",
    "dateReserved": "2025-05-01T14:05:17.248Z",
    "dateUpdated": "2026-05-11T19:09:05.818Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-49911",
      "date": "2026-09-16",
      "epss": "0.00178",
      "percentile": "0.07571"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-49911\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-05-01T15:16:16.260\",\"lastModified\":\"2026-06-17T05:19:29.653\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnetfilter: ipset: enforce documented limit to prevent allocating huge memory\\n\\nDaniel Xu reported that the hash:net,iface type of the ipset subsystem does\\nnot limit adding the same network with different interfaces to a set, which\\ncan lead to huge memory usage or allocation failure.\\n\\nThe quick reproducer is\\n\\n$ ipset create ACL.IN.ALL_PERMIT hash:net,iface hashsize 1048576 timeout 0\\n$ for i in $(seq 0 100); do /sbin/ipset add ACL.IN.ALL_PERMIT 0.0.0.0/0,kaf_$i timeout 0 -exist; done\\n\\nThe backtrace when vmalloc fails:\\n\\n        [Tue Oct 25 00:13:08 2022] ipset: vmalloc error: size 1073741848, exceeds total pages\\n        \u003c...\u003e\\n        [Tue Oct 25 00:13:08 2022] Call Trace:\\n        [Tue Oct 25 00:13:08 2022]  \u003cTASK\u003e\\n        [Tue Oct 25 00:13:08 2022]  dump_stack_lvl+0x48/0x60\\n        [Tue Oct 25 00:13:08 2022]  warn_alloc+0x155/0x180\\n        [Tue Oct 25 00:13:08 2022]  __vmalloc_node_range+0x72a/0x760\\n        [Tue Oct 25 00:13:08 2022]  ? hash_netiface4_add+0x7c0/0xb20\\n        [Tue Oct 25 00:13:08 2022]  ? __kmalloc_large_node+0x4a/0x90\\n        [Tue Oct 25 00:13:08 2022]  kvmalloc_node+0xa6/0xd0\\n        [Tue Oct 25 00:13:08 2022]  ? hash_netiface4_resize+0x99/0x710\\n        \u003c...\u003e\\n\\nThe fix is to enforce the limit documented in the ipset(8) manpage:\\n\\n\u003e  The internal restriction of the hash:net,iface set type is that the same\\n\u003e  network prefix cannot be stored with more than 64 different interfaces\\n\u003e  in a single set.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: netfilter: ipset: aplicar el l\u00edmite documentado para evitar la asignaci\u00f3n de grandes cantidades de memoria. Daniel Xu inform\u00f3 que el tipo hash:net,iface del subsistema ipset no limita la adici\u00f3n de la misma red con diferentes interfaces a un conjunto, lo que puede provocar un uso excesivo de memoria o fallos de asignaci\u00f3n. El reproductor r\u00e1pido es: $ ipset create ACL.IN.ALL_PERMIT hash:net,iface hashsize 1048576 timeout 0 $ for i in $(seq 0 100); do /sbin/ipset add ACL.IN.ALL_PERMIT 0.0.0.0/0,kaf_$i timeout 0 -exist; hecho El backtrace cuando vmalloc falla: [Tue Oct 25 00:13:08 2022] ipset: vmalloc error: size 1073741848, exceeds total pages \u0026lt;...\u0026gt; [Tue Oct 25 00:13:08 2022] Call Trace: [Tue Oct 25 00:13:08 2022]  [Tue Oct 25 00:13:08 2022] dump_stack_lvl+0x48/0x60 [Tue Oct 25 00:13:08 2022] warn_alloc+0x155/0x180 [Tue Oct 25 00:13:08 2022] __vmalloc_node_range+0x72a/0x760 [Tue Oct 25 00:13:08 2022] ? hash_netiface4_add+0x7c0/0xb20 [Tue Oct 25 00:13:08 2022] ? __kmalloc_large_node+0x4a/0x90 [Tue Oct 25 00:13:08 2022] kvmalloc_node+0xa6/0xd0 [Tue Oct 25 00:13:08 2022] ? hash_netiface4_resize+0x99/0x710 \u0026lt;...\u0026gt;  La soluci\u00f3n es aplicar el l\u00edmite documentado en la p\u00e1gina de manual de ipset(8): \u0026gt; La restricci\u00f3n interna del tipo de conjunto hash:net,iface es que el mismo prefijo de red no se puede almacenar con m\u00e1s de 64 interfaces diferentes en un solo conjunto.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/netfilter/ipset/ip_set_hash_gen.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"ccf0a4b7fc688561428290265e4effde41446668\",\"lessThan\":\"42d20d5e24575c9afa2d66d9a51e7386db9514f5\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ccf0a4b7fc688561428290265e4effde41446668\",\"lessThan\":\"a37ef32fe5956fe9248df68f6a61997845ba047e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ccf0a4b7fc688561428290265e4effde41446668\",\"lessThan\":\"510841da1fcc16f702440ab58ef0b4d82a9056b7\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/netfilter/ipset/ip_set_hash_gen.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.11\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.11\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.78\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.0.8\",\"lessThanOrEqual\":\"6.0.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.78\",\"matchCriteriaId\":\"AB8B27B9-B41B-42D5-AE67-0A89A8A8EEB1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.0.8\",\"matchCriteriaId\":\"EC9A754E-625D-42F3-87A7-960D643E2867\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.1:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"E7E331DA-1FB0-4DEC-91AC-7DA69D461C11\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.1:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"17F0B248-42CF-4AE6-A469-BB1BAE7F4705\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.1:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"E2422816-0C14-4B5E-A1E6-A9D776E5C49B\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/42d20d5e24575c9afa2d66d9a51e7386db9514f5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/510841da1fcc16f702440ab58ef0b4d82a9056b7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a37ef32fe5956fe9248df68f6a61997845ba047e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-06-29T21:30:08+00:00",
      "cve": "CVE-2022-49911",
      "id": "CVE-2022-49911",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:fixed": "201",
      "product_status:known_affected": "64",
      "product_status:known_not_affected": "124",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: netfilter: ipset: enforce documented limit to prevent allocating huge memory",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-49911.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-01T01:25:57Z",
      "cve": "CVE-2022-49911",
      "id": "CVE-2022-49911",
      "initial_release_date": "2025-05-11T02:06:15Z",
      "product_status:known_affected": "61",
      "product_status:known_not_affected": "444",
      "product_status:recommended": "27",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2022-49911",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2022-49911.json",
      "version": "11"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.