Exploiting nf_tables UAF (CVE-2022-32250)

This report documents a detailed analysis and exploit of CVE-2022-32250, a use-after-free in the Linux nf_tables netlink subsystem that allows a local attacker to achieve root via a complex chain of four UAFs. The authors describe vulnerability discovery, kernel structure layouts, exploitation primitives (user_key_payload, cgroup_fs_context, setxattr/FUSE), KASLR bypass using adjacent tty_struct leaks, and final control of a function pointer to overwrite modprobe_path and spawn a root shell; the write-up also includes the patch and disclosure timeline.