kernel/ucount.c in the Linux kernel 5.14 through 5.16.4, when unprivileged user namespaces are enabled, allows a use-after-free and privilege escalation because a ucounts object can outlive its namespace.

The Rocky Linux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_0438 advisory.

    This advisory aggregates security fixes for the kernel SRPM in CIQ LTS 9.2. It addresses 135 CVEs:
    CVE-2022-41674, CVE-2022-30594, CVE-2022-2959, CVE-2023-52628, CVE-2025-21727, and 130 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - kernel/ucount.c in the Linux kernel 5.14 through 5.16.4, when unprivileged user namespaces are enabled,     allows a use-after-free and privilege escalation because a ucounts object can outlive its namespace.
    (CVE-2022-24122)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the kernel-5.14.0-347.el9 build changelog.

  - A stack overflow flaw was found in the Linux kernel's TIPC protocol functionality in the way a user sends     a packet with malicious content where the number of domain member nodes is higher than the 64 allowed.
    This flaw allows a remote user to crash the system or possibly escalate their privileges if they have     access to the TIPC network. (CVE-2022-0435)

  - An issue was discovered in net/tipc/crypto.c in the Linux kernel before 5.14.16. The Transparent Inter-     Process Communication (TIPC) functionality allows remote attackers to exploit insufficient validation of     user-supplied sizes for the MSG_CRYPTO message type. (CVE-2021-43267)

  - A vulnerability was found in Linux kernel, where a use-after-frees in nouveau's postclose() handler could     happen if removing device (that is not common to remove video card physically without power-off, but same     happens if unbind the driver). (CVE-2020-27820)

  - An issue was discovered in the Linux kernel through 5.16.11. The mixed IPID assignment method with the     hash-based IPID assignment policy allows an off-path attacker to inject data into a victim's TCP session     or terminate that session. (CVE-2020-36516)

  - A flaw in the processing of received ICMP errors (ICMP fragment needed and ICMP redirect) in the Linux     kernel functionality was found to allow the ability to quickly scan open UDP ports. This flaw allows an     off-path remote user to effectively bypass the source port UDP randomization. The highest threat from this     vulnerability is to confidentiality and possibly integrity, because software that relies on UDP source     port randomization are indirectly affected as well. (CVE-2021-20322)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5278-1 advisory.

    It was discovered that the rlimit tracking for user namespaces in the Linux kernel did not properly     perform reference counting, leading to a use-after- free vulnerability. A local attacker could use this to     cause a denial of service or possibly execute arbitrary code. (CVE-2022-24122)

    It was discovered that the BPF verifier in the Linux kernel did not properly restrict pointer types in     certain situations. A local attacker could use this to cause a denial of service (system crash) or     possibly execute arbitrary code. (CVE-2022-23222)

    Jeremy Cline discovered a use-after-free in the nouveau graphics driver of the Linux kernel during device     removal. A privileged or physically proximate attacker could use this to cause a denial of service (system     crash). (CVE-2020-27820)

    It was discovered that the Packet network protocol implementation in the Linux kernel contained a double-     free vulnerability. A local attacker could use this to cause a denial of service (system crash) or     possibly execute arbitrary code. (CVE-2021-22600)

    Jrgen Gro discovered that the Xen subsystem within the Linux kernel did not adequately limit the     number of events driver domains (unprivileged PV backends) could send to other guest VMs. An attacker in a     driver domain could use this to cause a denial of service in other guest VMs. (CVE-2021-28713)

    Jrgen Gro discovered that the Xen network backend driver in the Linux kernel did not adequately limit     the amount of queued packets when a guest did not process them. An attacker in a guest VM can use this to     cause a denial of service (excessive kernel memory consumption) in the network backend domain.
    (CVE-2021-28714, CVE-2021-28715)

    Szymon Heidrich discovered that the USB Gadget subsystem in the Linux kernel did not properly restrict the     size of control requests for certain gadget types, leading to possible out of bounds reads or writes. A     local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary     code. (CVE-2021-39685)

    It was discovered that the eBPF implementation in the Linux kernel contained a race condition around read-     only maps. A privileged attacker could use this to modify read-only maps. (CVE-2021-4001)

    Jann Horn discovered a race condition in the Unix domain socket implementation in the Linux kernel that     could result in a read-after-free. A local attacker could use this to cause a denial of service (system     crash) or possibly execute arbitrary code. (CVE-2021-4083)

    It was discovered that the simulated networking device driver for the Linux kernel did not properly     initialize memory in certain situations. A local attacker could use this to expose sensitive information     (kernel memory). (CVE-2021-4135)

    Kirill Tkhai discovered that the XFS file system implementation in the Linux kernel did not calculate size     correctly when pre-allocating space in some situations. A local attacker could use this to expose     sensitive information. (CVE-2021-4155)

    Eric Biederman discovered that the cgroup process migration implementation in the Linux kernel did not     perform permission checks correctly in some situations. A local attacker could possibly use this to gain     administrative privileges. (CVE-2021-4197)

    Brendan Dolan-Gavitt discovered that the aQuantia AQtion Ethernet device driver in the Linux kernel did     not properly validate meta-data coming from the device. A local attacker who can control an emulated     device can use this to cause a denial of service (system crash) or possibly execute arbitrary code.
    (CVE-2021-43975)

    It was discovered that the ARM Trusted Execution Environment (TEE) subsystem in the Linux kernel contained     a race condition leading to a use- after-free vulnerability. A local attacker could use this to cause a     denial of service or possibly execute arbitrary code. (CVE-2021-44733)

    It was discovered that the Phone Network protocol (PhoNet) implementation in the Linux kernel did not     properly perform reference counting in some error conditions. A local attacker could possibly use this to     cause a denial of service (memory exhaustion). (CVE-2021-45095)

    It was discovered that the Reliable Datagram Sockets (RDS) protocol implementation in the Linux kernel did     not properly deallocate memory in some error conditions. A local attacker could possibly use this to cause     a denial of service (memory exhaustion). (CVE-2021-45480)

    It was discovered that the BPF subsystem in the Linux kernel did not properly track pointer types on     atomic fetch operations in some situations. A local attacker could use this to expose sensitive     information (kernel pointer addresses). (CVE-2022-0264)

    Sushma Venkatesh Reddy discovered that the Intel i915 graphics driver in the Linux kernel did not perform     a GPU TLB flush in some situations. A local attacker could use this to cause a denial of service or     possibly execute arbitrary code. (CVE-2022-0330)

    It was discovered that the TIPC Protocol implementation in the Linux kernel did not properly initialize     memory in some situations. A local attacker could use this to expose sensitive information (kernel     memory). (CVE-2022-0382)

    It was discovered that the VMware Virtual GPU driver in the Linux kernel did not properly handle certain     failure conditions, leading to a stale entry in the file descriptor table. A local attacker could use this     to expose sensitive information or possibly gain administrative privileges. (CVE-2022-22942)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
356103	Rocky Linux 9.2 [CIQ] Security Update: kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (ciqsa-2026_0438)	Nessus	Rocky Linux Local Security Checks	Local	critical
249730	Linux Distros Unpatched Vulnerability : CVE-2022-24122	Nessus	Misc.	Local	high
239841	TencentOS Server 4: kernel (TSSA-2024:0960)	Nessus	Tencent Local Security Checks	Local	critical
191192	CentOS 9 : kernel-5.14.0-347.el9	Nessus	CentOS Local Security Checks	Local	critical
157463	Ubuntu 20.04 LTS : Linux kernel (OEM) vulnerabilities (USN-5278-1)	Nessus	Ubuntu Local Security Checks	Local	high

Detections

Analytics

CVE-2022-24122

high

Tenable Plugins

critical

high

critical

critical

high