OSG-SEC-2022-10-17 HIGH Linux kernel use-after-free in cls_route filter
Dear OSG Security Contacts,
A use-after-free flaw was found in route4_change in the net/sched/cls_route.c filter implementation in the Linux kernel as described in CVE-2022-2588.  It was discovered that the cls_route filter implementation in the Linux kernel would not remove an old filter from the hashtable before freeing it if its handle had the value 0. 
RHEL 6, 7, 8 based distributions (RHEL 9 is not affected).  Ubuntu (all actively supported versions). 
WHAT ARE THE VULNERABILITIES:
This flaw allows a local user to crash the system and may allow local privilege escalation.
WHAT YOU SHOULD DO:
Patches for the kernel and mitigations for RHEL based distributions aren't yet available. We recommend you pay attention to CVE references and update the kernel when patched versions are available, and then restart the systems.
Patches for Debian/Ubuntu based distributions are available. Update the kernel with the patched versions, and restart the systems.
Sites running RHEL should see 
Sites running CentOS should also see 
Sites running Scientific Linux should see 
Sites running Debian should see 
Sites running Ubuntu should see 
Sites running RockyLinux should see 
Sites running Almalinux should see 
Please contact the OSG security team at [email protected] if you have any questions or concerns.
OSG Security Team