CVE catalog

CVE-2022-3534

libbpf affected and fixed versions

[CVE catalog]

A vulnerability has been found in Linux Kernel up to 5.10.162/5.15.85/6.0.15/6.1.1. The impacted element is the function btf_dump_name_dups of the file tools/lib/bpf/btf_dump.c of the component libbpf. The manipulation leads to use after free. Upgrading to version 5.10.163, 5.15.86, 6.0.16, 6.1.2 and 6.2 is sufficient to resolve this issue. The identifier of the patch is c61650b869e0b6fb0c0a28ed42d928eea969afc8/fbe08093fb2334549859829ef81d42570812597d/8c64a8e76eb85d422af5ec60ccbf26e3ead8c333/a733bf10198eb5bb927890940de8ab457491ed3b/93c660ca40b5d2f7c1b1626e955a8e9fa30e0749. You should upgrade the affected component.

Severity
High · CVSS 8CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
Published
Source
[NVD] · [CVE record]
EPSS
0.96% · Oct 27, 2026

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / releasePackageVersionStatusSource
Debiantrixielibbpf1.1.0-1FixedDistribution-reported fixed boundary[CVE-2022-3534]
Debiantrixielibbpf1.5.0-3Fixed[CVE-2022-3534]
Debiansidlibbpf1.1.0-1FixedDistribution-reported fixed boundary[CVE-2022-3534]
Debiansidlibbpf1.7.0-1Fixed[CVE-2022-3534]
Debianforkylibbpf1.1.0-1FixedDistribution-reported fixed boundary[CVE-2022-3534]
Debianforkylibbpf1.7.0-1Fixed[CVE-2022-3534]
Debianbookwormlibbpf1.1.0-1FixedDistribution-reported fixed boundary[CVE-2022-3534]
Debianbookwormlibbpf1.1.2-0+deb12u1Fixed[CVE-2022-3534]

Showing 8 fix observations. All 26 observations, including unknown and conflicting reports, are available below.

Provider details and historical evidence
Distribution / releasePackageVersionStatusSource
UnknownRelease not reportedlibbpf1.1.0-1UnknownSource applicability is not establishedProvider not reported
Debianbookwormlibbpf1.1.0-1FixedDistribution-reported fixed boundary[CVE-2022-3534]
Debianbookwormlibbpf1.1.2-0+deb12u1Fixed[CVE-2022-3534]
Debianforkylibbpf1.1.0-1FixedDistribution-reported fixed boundary[CVE-2022-3534]
Debianforkylibbpf1.7.0-1Fixed[CVE-2022-3534]
Debiansidlibbpf1.1.0-1FixedDistribution-reported fixed boundary[CVE-2022-3534]
Debiansidlibbpf1.7.0-1Fixed[CVE-2022-3534]
Debiantrixielibbpf1.1.0-1FixedDistribution-reported fixed boundary[CVE-2022-3534]
Debiantrixielibbpf1.5.0-3Fixed[CVE-2022-3534]
Opensuseleap 15.4libbpf0.5.0-150400.3.3.1UnknownSource applicability is not established[SUSE-SU-2023:0405-1]
Suselinux enterprise module for basesystem 15 sp4libbpf0.5.0-150400.3.3.1UnknownSource applicability is not established[SUSE-SU-2023:0405-1]
Ubuntu16.04dwarves-dfsg1.10-2.1UnknownSource applicability is not established[UBUNTU-CVE-2022-3534]
Ubuntu16.04dwarves-dfsg1.10-2ubuntu1UnknownSource applicability is not established[UBUNTU-CVE-2022-3534]
Ubuntu20.04dwarves-dfsg1.15-1UnknownSource applicability is not established[UBUNTU-CVE-2022-3534][USN-6215-1]
Ubuntu20.04dwarves-dfsg1.15-2UnknownSource applicability is not established[UBUNTU-CVE-2022-3534][USN-6215-1]
Ubuntu20.04dwarves-dfsg1.21-0ubuntu1~20.04UnknownSource applicability is not established[UBUNTU-CVE-2022-3534][USN-6215-1]
Ubuntu20.04dwarves-dfsg1.21-0ubuntu1~20.04.1UnknownSource applicability is not established[UBUNTU-CVE-2022-3534][USN-6215-1]
Ubuntu22.04libbpf0.4.0-1ubuntu1UnknownSource applicability is not established[UBUNTU-CVE-2022-3534]
Ubuntu22.04libbpf0.5.0-1UnknownSource applicability is not established[UBUNTU-CVE-2022-3534]
Ubuntu22.04libbpf0.5.0-1ubuntu22.04.1UnknownSource applicability is not established[UBUNTU-CVE-2022-3534]
Ubuntuprodwarves-dfsg1.10-2.1UnknownSource applicability is not established[UBUNTU-CVE-2022-3534][USN-6215-1]
Ubuntuprodwarves-dfsg1.10-2.1build1UnknownSource applicability is not established[UBUNTU-CVE-2022-3534][USN-6215-1]
Ubuntuprodwarves-dfsg1.21-0ubuntu1~18.04UnknownSource applicability is not established[UBUNTU-CVE-2022-3534][USN-6215-1]
Ubuntuprodwarves-dfsg1.21-0ubuntu1~18.04.1+esm1UnknownSource applicability is not established[UBUNTU-CVE-2022-3534][USN-6215-1]
Ubuntuprolibbpf0.5.0-1~ubuntu20.04.1UnknownSource applicability is not established[UBUNTU-CVE-2022-3534][USN-5759-2]
Ubuntuprolibbpf0.5.0-1~ubuntu20.04.1+esm1UnknownSource applicability is not established[UBUNTU-CVE-2022-3534][USN-5759-2]
Original provider fields
{
  "package_releases": [
    {
      "name": "libbpf",
      "status": "fixed",
      "release": "sid",
      "version": "1.7.0-1"
    },
    {
      "name": "libbpf",
      "status": "fixed",
      "release": "forky",
      "version": "1.7.0-1"
    },
    {
      "name": "libbpf",
      "status": "fixed",
      "release": "trixie",
      "version": "1.5.0-3"
    },
    {
      "name": "libbpf",
      "status": "fixed",
      "release": "bookworm",
      "version": "1.1.2-0+deb12u1"
    }
  ],
  "fixed_versions": [
    {
      "bug": 1023717,
      "name": "libbpf",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "not yet assigned",
      "fixed_version": "1.1.0-1"
    },
    {
      "bug": 1023717,
      "name": "libbpf",
      "type": "source",
      "origin": null,
      "release": "forky",
      "urgency": "not yet assigned",
      "fixed_version": "1.1.0-1"
    },
    {
      "bug": 1023717,
      "name": "libbpf",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "not yet assigned",
      "fixed_version": "1.1.0-1"
    },
    {
      "bug": 1023717,
      "name": "libbpf",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "not yet assigned",
      "fixed_version": "1.1.0-1"
    }
  ],
  "distribution_packages": [
    {
      "name": "libbpf",
      "fixed_version": "1.1.0-1",
      "applicability_unknown": true
    },
    {
      "name": "debian_linux",
      "ranges": [],
      "ecosystem": "cpe",
      "provider_url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3534",
      "fixed_version": "",
      "provider_source": "nvd",
      "provider_record_id": "NVD-CVE-2022-3534",
      "provider_updated_at": "2026-10-14T14:17:23.940"
    },
    {
      "name": "linux_kernel",
      "ranges": [
        {
          "fixed": "6.1.2",
          "introduced": "6.1",
          "last_affected": "",
          "start_excluding": ""
        }
      ],
      "ecosystem": "cpe",
      "provider_url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3534",
      "fixed_version": "6.1.2",
      "provider_source": "nvd",
      "provider_record_id": "NVD-CVE-2022-3534",
      "provider_updated_at": "2026-10-14T14:17:23.940"
    },
    {
      "name": "dwarves-dfsg",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "16.04",
      "versions": [
        "1.10-2ubuntu1",
        "1.10-2.1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2022-3534",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2022-3534",
      "provider_updated_at": "2026-10-28T20:15:18.157125719Z",
      "applicability_unknown": true
    },
    {
      "name": "dwarves-dfsg",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.21-0ubuntu1~18.04.1+esm1"
            }
          ]
        }
      ],
      "release": "pro",
      "versions": [
        "1.10-2.1",
        "1.10-2.1build1",
        "1.21-0ubuntu1~18.04"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2022-3534",
      "fixed_version": "1.21-0ubuntu1~18.04.1+esm1",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2022-3534",
      "provider_updated_at": "2026-10-28T20:15:18.157125719Z",
      "applicability_unknown": true
    },
    {
      "name": "dwarves-dfsg",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.21-0ubuntu1~20.04.1"
            }
          ]
        }
      ],
      "release": "20.04",
      "versions": [
        "1.15-1",
        "1.15-2",
        "1.21-0ubuntu1~20.04"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2022-3534",
      "fixed_version": "1.21-0ubuntu1~20.04.1",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2022-3534",
      "provider_updated_at": "2026-10-28T20:15:18.157125719Z",
      "applicability_unknown": true
    },
    {
      "name": "libbpf",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.5.0-1~ubuntu20.04.1+esm1"
            }
          ]
        }
      ],
      "release": "pro",
      "versions": [
        "0.5.0-1~ubuntu20.04.1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2022-3534",
      "fixed_version": "0.5.0-1~ubuntu20.04.1+esm1",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2022-3534",
      "provider_updated_at": "2026-10-28T20:15:18.157125719Z",
      "applicability_unknown": true
    },
    {
      "name": "libbpf",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.5.0-1ubuntu22.04.1"
            }
          ]
        }
      ],
      "release": "22.04",
      "versions": [
        "0.4.0-1ubuntu1",
        "0.5.0-1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2022-3534",
      "fixed_version": "0.5.0-1ubuntu22.04.1",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2022-3534",
      "provider_updated_at": "2026-10-28T20:15:18.157125719Z",
      "applicability_unknown": true
    },
    {
      "name": "dwarves-dfsg",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.21-0ubuntu1~18.04.1+esm1"
            }
          ]
        }
      ],
      "release": "pro",
      "versions": [
        "1.10-2.1",
        "1.10-2.1build1",
        "1.21-0ubuntu1~18.04"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/USN-6215-1",
      "fixed_version": "1.21-0ubuntu1~18.04.1+esm1",
      "provider_source": "pypi",
      "provider_record_id": "USN-6215-1",
      "provider_updated_at": "2026-07-30T16:00:36.002561418Z",
      "applicability_unknown": true
    },
    {
      "name": "dwarves-dfsg",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.21-0ubuntu1~20.04.1"
            }
          ]
        }
      ],
      "release": "20.04",
      "versions": [
        "1.15-1",
        "1.15-2",
        "1.21-0ubuntu1~20.04"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/USN-6215-1",
      "fixed_version": "1.21-0ubuntu1~20.04.1",
      "provider_source": "pypi",
      "provider_record_id": "USN-6215-1",
      "provider_updated_at": "2026-07-30T16:00:36.002561418Z",
      "applicability_unknown": true
    },
    {
      "name": "libbpf",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.5.0-1~ubuntu20.04.1+esm1"
            }
          ]
        }
      ],
      "release": "pro",
      "versions": [
        "0.5.0-1~ubuntu20.04.1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/USN-5759-2",
      "fixed_version": "0.5.0-1~ubuntu20.04.1+esm1",
      "provider_source": "pypi",
      "provider_record_id": "USN-5759-2",
      "provider_updated_at": "2026-07-30T16:00:34.749130929Z",
      "applicability_unknown": true
    },
    {
      "name": "libbpf",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.5.0-150400.3.3.1"
            }
          ]
        }
      ],
      "release": "linux enterprise module for basesystem 15 sp4",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2023:0405-1",
      "fixed_version": "0.5.0-150400.3.3.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2023:0405-1",
      "provider_updated_at": "2026-02-04T02:57:03.137692Z",
      "applicability_unknown": true
    },
    {
      "name": "libbpf",
      "distro": "opensuse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.5.0-150400.3.3.1"
            }
          ]
        }
      ],
      "release": "leap 15.4",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2023:0405-1",
      "fixed_version": "0.5.0-150400.3.3.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2023:0405-1",
      "provider_updated_at": "2026-02-04T02:57:03.137692Z",
      "applicability_unknown": true
    }
  ]
}

[Debian bug #1023717]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

  • [libbpf1]Unknown

    Source package: [libbpf]

    Details (4)

    • 1:1.1.2-0+deb12u1 · amd64 · bookworm

      Fixed · Fixed: 1.1.0-1

      dsa · libbpf · debian · bookworm

    • 1:1.1.2-0+deb12u1 · arm64 · bookworm

      Fixed · Fixed: 1.1.0-1

      dsa · libbpf · debian · bookworm

    • 1:1.4.6-1~bpo12+1 · amd64 · bookworm-backports

      Fixed · Fixed: 1.1.0-1

      dsa · libbpf · debian · bookworm

    • 1:1.4.6-1~bpo12+1 · arm64 · bookworm-backports

      Fixed · Fixed: 1.1.0-1

      dsa · libbpf · debian · bookworm

  • [libbpf-dev]Unknown

    Source package: [libbpf]

    Details (4)

    • 1:1.1.2-0+deb12u1 · amd64 · bookworm

      Fixed · Fixed: 1.1.0-1

      dsa · libbpf · debian · bookworm

    • 1:1.1.2-0+deb12u1 · arm64 · bookworm

      Fixed · Fixed: 1.1.0-1

      dsa · libbpf · debian · bookworm

    • 1:1.4.6-1~bpo12+1 · amd64 · bookworm-backports

      Fixed · Fixed: 1.1.0-1

      dsa · libbpf · debian · bookworm

    • 1:1.4.6-1~bpo12+1 · arm64 · bookworm-backports

      Fixed · Fixed: 1.1.0-1

      dsa · libbpf · debian · bookworm

Observed:

References

[CERT-Bund public advisories] · [CISA cybersecurity advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]