{"id":"DEBIAN-CVE-2022-48974","details":"In the Linux kernel, the following vulnerability has been resolved:  netfilter: conntrack: fix using __this_cpu_add in preemptible  Currently in nf_conntrack_hash_check_insert(), when it fails in nf_ct_ext_valid_pre/post(), NF_CT_STAT_INC() will be called in the preemptible context, a call trace can be triggered:     BUG: using __this_cpu_add() in preemptible [00000000] code: conntrack/1636    caller is nf_conntrack_hash_check_insert+0x45/0x430 [nf_conntrack]    Call Trace:     \u003cTASK\u003e     dump_stack_lvl+0x33/0x46     check_preemption_disabled+0xc3/0xf0     nf_conntrack_hash_check_insert+0x45/0x430 [nf_conntrack]     ctnetlink_create_conntrack+0x3cd/0x4e0 [nf_conntrack_netlink]     ctnetlink_new_conntrack+0x1c0/0x450 [nf_conntrack_netlink]     nfnetlink_rcv_msg+0x277/0x2f0 [nfnetlink]     netlink_rcv_skb+0x50/0x100     nfnetlink_rcv+0x65/0x144 [nfnetlink]     netlink_unicast+0x1ae/0x290     netlink_sendmsg+0x257/0x4f0     sock_sendmsg+0x5f/0x70  This patch is to fix it by changing to use NF_CT_STAT_INC_ATOMIC() for nf_ct_ext_valid_pre/post() check in nf_conntrack_hash_check_insert(), as well as nf_ct_ext_valid_post() in __nf_conntrack_confirm().  Note that nf_ct_ext_valid_pre() check in __nf_conntrack_confirm() is safe to use NF_CT_STAT_INC(), as it's under local_bh_disable().","modified":"2026-08-27T23:04:45.860292179Z","published":"2024-10-21T20:15:09.517Z","upstream":["CVE-2022-48974"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2022-48974"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:12","purl":"pkg:deb/debian/linux?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.4-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2022-48974.json"}},{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.4-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2022-48974.json"}},{"package":{"name":"linux","ecosystem":"Debian:14","purl":"pkg:deb/debian/linux?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.4-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2022-48974.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}]}