In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_tables: fix memleak when more than 255 elements expired
When more than 255 elements expired we're supposed to switch to a new gc container structure.
This never happens: u8 type will wrap before reaching the boundary and nft_trans_gc_space() always returns true.
This means we recycle the initial gc container structure and lose track of the elements that came before.
While at it, don't deref 'gc' after we've passed it to call_rcu.
CVSS Details
- CVSS 3.1 Base Score: 6.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-modules-extraUpgrade kernel-modulesUpgrade kernel-uki-virtUpgrade kernel-develUpgrade kernel-headersUpgrade kernel-rt-debug-modules-extraUpgrade kernel-rt-debug-develUpgrade kernel-rt-debug-modules-coreUpgrade kernel-modules-coreUpgrade kernel-zfcpdump-develUpgrade kernel-64k-modules-coreUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-rt-debug-modulesUpgrade kernel-rt-modules-coreUpgrade kernel-debug-devel-matchedUpgrade kernel-64k-develUpgrade kernel-64k-devel-matchedUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-zfcpdumpUpgrade perfUpgrade kernel-64k-modules-extraUpgrade kernel-debug-develUpgrade kernel-debug-coreUpgrade kernel-abi-stablelistsUpgrade rtlaUpgrade kernel-64k-debug-modules-extraUpgrade libperfUpgrade kernel-64k-debug-modules-coreUpgrade kernel-debugUpgrade kernel-rtUpgrade kernel-docUpgrade kernel-debug-uki-virtUpgrade kernel-zfcpdump-modulesUpgrade kernel-toolsUpgrade kernel-rt-debug-kvmUpgrade rvUpgrade kernel-coreUpgrade kernel-devel-matchedUpgrade kernel-rt-modulesUpgrade kernel-64kUpgrade kernel-64k-modulesUpgrade kernel-rt-develUpgrade kernel-rt-modules-extraUpgrade kernel-zfcpdump-coreUpgrade bpftoolUpgrade kernelUpgrade kernel-64k-debug-modulesUpgrade kernel-rt-debugUpgrade kernel-cross-headersUpgrade kernel-64k-coreUpgrade kernel-rt-coreUpgrade kernel-rt-kvmUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-debug-modulesUpgrade kernel-tools-libsUpgrade kernel-64k-debug-coreUpgrade python3-perfUpgrade kernel-tools-libs-develUpgrade kernel-rt-debug-coreUpgrade kernel-64k-debugUpgrade kernel-debug-modules-coreUpgrade kernel-64k-debug-devel-matchedUpgrade kernel-64k-debug-develUpgrade kernel-debug-modules-extra | May 31, 2024 | Mar 2, 2024 |
| Debian | — | Upgrade linux | Jul 27, 2026 | Jul 27, 2026 |
| Oracle_linux | — | Upgrade kernel | May 14, 2024 | Mar 2, 2024 |
| Redhat_linux | — | No solution existsUpgrade kernelUpgrade kernel-rt | May 23, 2024 | Mar 2, 2024 |
| Rocky_linux | — | Upgrade kernel-rtUpgrade kernel-rt-kvmUpgrade perfUpgrade kernel-toolsUpgrade kernel-develUpgrade kernel-rt-debuginfo-common-x86_64Upgrade kernel-rt-debug-debuginfoUpgrade kernel-tools-libsUpgrade kernel-rt-modules-extraUpgrade kernel-rt-modulesUpgrade python3-perf-debuginfoUpgrade kernel-rt-debugUpgrade kernel-rt-develUpgrade bpftoolUpgrade kernel-debug-modulesUpgrade kernel-debug-modules-extraUpgrade kernel-rt-debuginfoUpgrade kernel-tools-libs-develUpgrade kernel-rt-debug-coreUpgrade bpftool-debuginfoUpgrade kernel-debug-debuginfoUpgrade kernel-modules-extraUpgrade kernel-debugUpgrade kernel-rt-debug-develUpgrade kernel-debug-develUpgrade perf-debuginfoUpgrade kernel-rt-coreUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-debug-coreUpgrade kernel-modulesUpgrade kernel-rt-debug-kvmUpgrade kernel-tools-debuginfoUpgrade python3-perfUpgrade kernel-coreUpgrade kernel-rt-debug-modules-extraUpgrade kernel-cross-headersUpgrade kernel-headersUpgrade kernel-rt-debug-modulesUpgrade kernel-debuginfoUpgrade kernel | Jun 17, 2024 | Mar 2, 2024 |
| Suse | — | Upgrade kernel-symsUpgrade kernel-docsUpgrade kernel-preemptUpgrade reiserfs-kmp-defaultUpgrade kernel-develUpgrade kernel-macrosUpgrade kernel-64kb-develUpgrade kernel-defaultUpgrade kernel-zfcpdumpUpgrade kernel-preempt-develUpgrade kernel-sourceUpgrade kernel-default-baseUpgrade kernel-64kbUpgrade kernel-default-develUpgrade kernel-obs-build | Jun 26, 2024 | Mar 2, 2024 |
| Ubuntu | — | Upgrade linux-hwe-5.15Upgrade linux-azure-fdeUpgrade linux-lowlatency-hwe-5.15Upgrade linux-bluefieldUpgrade linux-gcpUpgrade linux-awsUpgrade linux-laptopUpgrade linux-aws-5.15Upgrade linux-lowlatency-hwe-6.5Upgrade linux-nvidia-tegra-5.15Upgrade linux-gkeop-5.15Upgrade linux-hwe-6.5Upgrade linux-azureUpgrade linuxUpgrade linux-nvidia-6.5Upgrade linux-gcp-fipsUpgrade linux-intel-iot-realtimeUpgrade linux-starfiveUpgrade linux-riscvUpgrade linux-azure-5.15Upgrade linux-realtimeUpgrade linux-lowlatencyUpgrade linux-ibmUpgrade linux-ibm-5.15Upgrade linux-intel-iotg-5.15Upgrade linux-gkeopUpgrade linux-fipsUpgrade linux-kvmUpgrade linux-raspiUpgrade linux-gcp-5.15Upgrade linux-oracleUpgrade linux-nvidia-tegraUpgrade linux-xilinx-zynqmpUpgrade linux-gkeUpgrade linux-oem-6.5Upgrade linux-oracle-6.5Upgrade linux-oracle-5.15Upgrade linux-aws-fipsUpgrade linux-nvidiaUpgrade linux-riscv-5.15Upgrade linux-nvidia-tegra-igxUpgrade linux-gcp-6.5Upgrade linux-intel-iotg | Nov 19, 2024 | Mar 2, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Mar 2, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub