In the Linux kernel, the following vulnerability has been resolved:
netfilter: nft_objref: validate objref and objrefmap expressions
Referencing a synproxy stateful object from OUTPUT hook causes kernel crash due to infinite recursive calls:
BUG: TASK stack guard page was hit at 000000008bda5b8c (stack is 000000003ab1c4a5..00000000494d8b12) [...] Call Trace: __find_rr_leaf+0x99/0x230 fib6_table_lookup+0x13b/0x2d0 ip6_pol_route+0xa4/0x400 fib6_rule_lookup+0x156/0x240 ip6_route_output_flags+0xc6/0x150 __nf_ip6_route+0x23/0x50 synproxy_send_tcp_ipv6+0x106/0x200 synproxy_send_client_synack_ipv6+0x1aa/0x1f0 nft_synproxy_do_eval+0x263/0x310 nft_do_chain+0x5a8/0x5f0 [nf_tables nft_do_chain_inet+0x98/0x110 nf_hook_slow+0x43/0xc0 __ip6_local_out+0xf0/0x170 ip6_local_out+0x17/0x70 synproxy_send_tcp_ipv6+0x1a2/0x200 synproxy_send_client_synack_ipv6+0x1aa/0x1f0 [...]
Implement objref and objrefmap expression validate functions.
Currently, only NFT_OBJECT_SYNPROXY object type requires validation. This will also handle a jump to a chain using a synproxy object from the OUTPUT hook.
Now when trying to reference a synproxy object in the OUTPUT hook, nft will produce the following error:
synproxy_crash.nft: Error: Could not process rule: Operation not supported synproxy name mysynproxy ^^^^^^^^^^^^^^^^^^^^^^^^
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade kernel-livepatch-6.12.55-74.119Upgrade bpftool6.12Upgrade perf6.12Upgrade kernel6.12-libbpf-develUpgrade kernel6.12-libbpf-debuginfoUpgrade kernel6.12-headersUpgrade kernel6.12Upgrade kernel6.12-debuginfo-common-aarch64Upgrade kernel6.12-toolsUpgrade kernel6.12-tools-develUpgrade python3-perf6.12Upgrade kernel6.12-tools-debuginfoUpgrade python3-perf6.12-debuginfoUpgrade kernel6.12-modules-extra-commonUpgrade kernel6.12-modules-extraUpgrade bpftool6.12-debuginfoUpgrade kernel6.12-libbpfUpgrade kernel6.12-libbpf-staticUpgrade kernel6.12-develUpgrade kernel6.12-debuginfoUpgrade perf6.12-debuginfoUpgrade kernel6.12-debuginfo-common-x86_64 | Dec 9, 2025 | Nov 12, 2025 |
| Debian | — | Upgrade linux | Jul 23, 2026 | Jul 23, 2026 |
| Huawei Euleros 2_0_sp12 | — | Upgrade kernelUpgrade kernel-abi-stablelistsUpgrade kernel-toolsUpgrade bpftoolUpgrade kernel-tools-libsUpgrade python3-perf | Mar 17, 2026 | Mar 16, 2026 |
| Huawei Euleros 2_0_sp13 | — | Upgrade python3-perfUpgrade kernel-abi-stablelistsUpgrade kernel-toolsUpgrade kernelUpgrade kernel-tools-libsUpgrade bpftool | Mar 10, 2026 | Mar 10, 2026 |
| Redhat_linux | — | No solution exists | Jul 17, 2026 | Nov 12, 2025 |
| Ubuntu | — | Upgrade linux-image-6.8.0-106-lowlatencyUpgrade linux-image-realtime-6.17Upgrade linux-image-aws-6.17Upgrade linux-image-nvidia-lowlatency-6.8Upgrade linux-image-6.8.0-1035-gkeopUpgrade linux-image-nvidia-6.8Upgrade linux-image-6.8.0-1051-azureUpgrade linux-image-gcp-fipsUpgrade linux-image-ibm-6.8Upgrade linux-image-lowlatencyUpgrade linux-image-azure-6.17Upgrade linux-image-6.17.0-1007-gcpUpgrade linux-image-oem-22.04dUpgrade linux-image-6.8.0-1049-nvidia-lowlatency-64kUpgrade linux-image-oracle-lts-24.04Upgrade linux-image-genericUpgrade linux-image-generic-64k-6.17Upgrade linux-image-6.17.0-1008-azureUpgrade linux-image-6.8.0-1048-gkeUpgrade linux-image-gke-6.8Upgrade linux-image-6.8.0-106-lowlatency-64kUpgrade linux-image-oem-22.04Upgrade linux-image-6.8.0-1052-azure-fipsUpgrade linux-image-6.8.1-1045-realtimeUpgrade linux-image-aws-6.8Upgrade linux-image-gcp-64k-6.17Upgrade linux-image-lowlatency-64kUpgrade linux-image-6.8.0-1052-gcp-64kUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-6.17.0-14-genericUpgrade linux-image-6.8.0-1048-gke-64kUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-generic-64kUpgrade linux-image-gkeop-6.8Upgrade linux-image-raspi-6.17Upgrade linux-image-6.8.0-1049-nvidiaUpgrade linux-image-oracle-6.8Upgrade linux-image-oracle-64kUpgrade linux-image-oracle-64k-lts-24.04Upgrade linux-image-virtual-hwe-22.04Upgrade linux-image-raspiUpgrade linux-image-6.8.0-106-fipsUpgrade linux-image-azure-lts-24.04Upgrade linux-image-6.8.0-1049-nvidia-lowlatencyUpgrade linux-image-nvidiaUpgrade linux-image-xilinx-6.8Upgrade linux-image-aws-64k-6.17Upgrade linux-image-realtime-hwe-22.04Upgrade linux-image-nvidia-64kUpgrade linux-image-oem-22.04bUpgrade linux-image-generic-6.17Upgrade linux-image-aws-lts-24.04Upgrade linux-image-6.8.0-1049-ibmUpgrade linux-image-intel-iot-realtimeUpgrade linux-image-ibmUpgrade linux-image-gkeopUpgrade linux-image-raspi-6.8Upgrade linux-image-6.17.0-1007-oracle-64kUpgrade linux-image-realtime-6.8.1Upgrade linux-image-virtual-6.8Upgrade linux-image-virtual-6.17Upgrade linux-image-generic-hwe-22.04Upgrade linux-image-gke-64k-6.8Upgrade linux-image-intel-iotgUpgrade linux-image-raspi-realtime-6.8Upgrade linux-image-oem-22.04aUpgrade linux-image-oracle-64k-6.8Upgrade linux-image-azureUpgrade linux-image-6.8.0-2040-raspi-realtimeUpgrade linux-image-oem-22.04cUpgrade linux-image-gcp-64kUpgrade linux-image-ibm-classicUpgrade linux-image-gcpUpgrade linux-image-gcp-fips-6.8Upgrade linux-image-gke-64kUpgrade linux-image-6.17.0-1007-aws-64kUpgrade linux-image-6.8.0-106-genericUpgrade linux-image-6.17.0-1007-oracleUpgrade linux-image-azure-fipsUpgrade linux-image-aws-64kUpgrade linux-image-6.8.0-1052-gcp-fipsUpgrade linux-image-lowlatency-6.8Upgrade linux-image-awsUpgrade linux-image-6.17.0-1007-gcp-64kUpgrade linux-image-aws-fips-6.8Upgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-aws-fipsUpgrade linux-image-6.17.0-1008-raspiUpgrade linux-image-6.17.0-1007-awsUpgrade linux-image-oem-6.17Upgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-aws-64k-6.8Upgrade linux-image-6.8.0-1050-raspiUpgrade linux-image-virtualUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-gcp-6.17Upgrade linux-image-fips-6.8Upgrade linux-image-6.8.0-1047-oracle-64kUpgrade linux-image-6.8.0-1052-gcpUpgrade linux-image-gcp-lts-24.04Upgrade linux-image-nvidia-64k-6.8Upgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-nvidia-lowlatency-64k-6.8Upgrade linux-image-generic-64k-6.8Upgrade linux-image-6.17.0-1011-oemUpgrade linux-image-gcp-64k-lts-24.04Upgrade linux-image-fipsUpgrade linux-image-oracleUpgrade linux-image-gcp-64k-6.8Upgrade linux-image-kvmUpgrade linux-image-6.17.0-1006-realtimeUpgrade linux-image-generic-6.8Upgrade linux-image-oracle-6.17Upgrade linux-image-azure-fips-6.8Upgrade linux-image-aws-64k-lts-24.04Upgrade linux-image-6.8.0-1050-awsUpgrade linux-image-gcp-6.8Upgrade linux-image-generic-lpaeUpgrade linux-image-6.8.0-1029-xilinxUpgrade linux-image-xilinx-zynqmpUpgrade linux-image-gkeUpgrade linux-image-raspi-realtimeUpgrade linux-image-6.8.0-1047-oracleUpgrade linux-image-xilinxUpgrade linux-image-realtimeUpgrade linux-image-6.8.0-1050-aws-64kUpgrade linux-image-6.8.0-106-generic-64kUpgrade linux-image-oracle-64k-6.17Upgrade linux-image-6.8.0-1050-aws-fipsUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-lowlatency-64k-6.8Upgrade linux-image-azure-6.8Upgrade linux-image-6.8.0-1049-nvidia-64kUpgrade linux-image-6.17.0-14-generic-64k | Feb 13, 2026 | Feb 12, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub