In the Linux kernel, the following vulnerability has been resolved:
net/sched: flower: Fix chain template offload
When a qdisc is deleted from a net device the stack instructs the underlying driver to remove its flow offload callback from the associated filter block using the 'FLOW_BLOCK_UNBIND' command. The stack then continues to replay the removal of the filters in the block for this driver by iterating over the chains in the block and invoking the 'reoffload' operation of the classifier being used. In turn, the classifier in its 'reoffload' operation prepares and emits a 'FLOW_CLS_DESTROY' command for each filter.
However, the stack does not do the same for chain templates and the underlying driver never receives a 'FLOW_CLS_TMPLT_DESTROY' command when a qdisc is deleted. This results in a memory leak [1] which can be reproduced using [2].
Fix by introducing a 'tmplt_reoffload' operation and have the stack invoke it with the appropriate arguments as part of the replay. Implement the operation in the sole classifier that supports chain templates (flower) by emitting the 'FLOW_CLS_TMPLT_{CREATE,DESTROY}' command based on whether a flow offload callback is being bound to a filter block or being unbound from one.
As far as I can tell, the issue happens since cited commit which reordered tcf_block_offload_unbind() before tcf_block_flush_all_chains() in __tcf_block_put(). The order cannot be reversed as the filter block is expected to be freed after flushing all the chains.
[1] unreferenced object 0xffff888107e28800 (size 2048): comm "tc", pid 1079, jiffies 4294958525 (age 3074.287s) hex dump (first 32 bytes): b1 a6 7c 11 81 88 ff ff e0 5b b3 10 81 88 ff ff ..|......[...... 01 00 00 00 00 00 00 00 e0 aa b0 84 ff ff ff ff ................ backtrace: [<ffffffff81c06a68>] __kmem_cache_alloc_node+0x1e8/0x320 [<ffffffff81ab374e>] __kmalloc+0x4e/0x90 [<ffffffff832aec6d>] mlxsw_sp_acl_ruleset_get+0x34d/0x7a0 [<ffffffff832bc195>] mlxsw_sp_flower_tmplt_create+0x145/0x180 [<ffffffff832b2e1a>] mlxsw_sp_flow_block_cb+0x1ea/0x280 [<ffffffff83a10613>] tc_setup_cb_call+0x183/0x340 [<ffffffff83a9f85a>] fl_tmplt_create+0x3da/0x4c0 [<ffffffff83a22435>] tc_ctl_chain+0xa15/0x1170 [<ffffffff838a863c>] rtnetlink_rcv_msg+0x3cc/0xed0 [<ffffffff83ac87f0>] netlink_rcv_skb+0x170/0x440 [<ffffffff83ac6270>] netlink_unicast+0x540/0x820 [<ffffffff83ac6e28>] netlink_sendmsg+0x8d8/0xda0 [<ffffffff83793def>] ____sys_sendmsg+0x30f/0xa80 [<ffffffff8379d29a>] ___sys_sendmsg+0x13a/0x1e0 [<ffffffff8379d50c>] __sys_sendmsg+0x11c/0x1f0 [<ffffffff843b9ce0>] do_syscall_64+0x40/0xe0 unreferenced object 0xffff88816d2c0400 (size 1024): comm "tc", pid 1079, jiffies 4294958525 (age 3074.287s) hex dump (first 32 bytes): 40 00 00 00 00 00 00 00 57 f6 38 be 00 00 00 00 @.......W.8..... 10 04 2c 6d 81 88 ff ff 10 04 2c 6d 81 88 ff ff ..,m......,m.... backtrace: [<ffffffff81c06a68>] __kmem_cache_alloc_node+0x1e8/0x320 [<ffffffff81ab36c1>] __kmalloc_node+0x51/0x90 [<ffffffff81a8ed96>] kvmalloc_node+0xa6/0x1f0 [<ffffffff82827d03>] bucket_table_alloc.isra.0+0x83/0x460 [<ffffffff82828d2b>] rhashtable_init+0x43b/0x7c0 [<ffffffff832aed48>] mlxsw_sp_acl_ruleset_get+0x428/0x7a0 [<ffffffff832bc195>] mlxsw_sp_flower_tmplt_create+0x145/0x180 [<ffffffff832b2e1a>] mlxsw_sp_flow_block_cb+0x1ea/0x280 [<ffffffff83a10613>] tc_setup_cb_call+0x183/0x340 [<ffffffff83a9f85a>] fl_tmplt_create+0x3da/0x4c0 [<ffffffff83a22435>] tc_ctl_chain+0xa15/0x1170 [<ffffffff838a863c>] rtnetlink_rcv_msg+0x3cc/0xed0 [<ffffffff83ac87f0>] netlink_rcv_skb+0x170/0x440 [<ffffffff83ac6270>] netlink_unicast+0x540/0x820 [<ffffffff83ac6e28>] netlink_sendmsg+0x8d8/0xda0 [<ffffffff83793def>] ____sys_sendmsg+0x30f/0xa80
[2] # tc qdisc add dev swp1 clsact # tc chain add dev swp1 ingress proto ip chain 1 flower dst_ip 0.0.0.0/32 # tc qdisc del dev ---truncated---
CVSS Details
- CVSS 3.1 Base Score: 7.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-docUpgrade python3-perfUpgrade kernel-rt-debug-kvmUpgrade kernel-debug-modules-extraUpgrade kernel-rt-debug-modules-extraUpgrade perfUpgrade kernel-zfcpdumpUpgrade kernel-rt-debug-modulesUpgrade kernel-modulesUpgrade kernel-headersUpgrade kernel-debug-coreUpgrade kernel-coreUpgrade kernel-debugUpgrade kernel-abi-stablelistsUpgrade kernel-debug-develUpgrade kernel-rt-modulesUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-rt-debug-develUpgrade kernel-rt-coreUpgrade kernel-zfcpdump-develUpgrade kernel-modules-extraUpgrade kernel-toolsUpgrade kernel-rtUpgrade kernel-develUpgrade kernel-rt-debugUpgrade bpftoolUpgrade kernel-zfcpdump-modulesUpgrade kernel-rt-develUpgrade kernel-rt-modules-extraUpgrade kernelUpgrade kernel-rt-debug-coreUpgrade kernel-debug-modulesUpgrade kernel-zfcpdump-coreUpgrade kernel-rt-kvmUpgrade kernel-cross-headersUpgrade kernel-tools-libs-develUpgrade kernel-tools-libs | Aug 12, 2024 | Apr 2, 2024 |
| Debian | — | No solution existsUpgrade linux | May 15, 2025 | Apr 2, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade kernel-toolsUpgrade kernel-tools-libsUpgrade kernelUpgrade kernel-abi-stablelistsUpgrade python3-perf | Jul 16, 2024 | Apr 2, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade kernel-abi-stablelistsUpgrade kernel-tools-libsUpgrade kernel-toolsUpgrade bpftoolUpgrade python3-perfUpgrade kernel | Jun 26, 2024 | Apr 2, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade bpftoolUpgrade kernel-tools-libsUpgrade python3-perfUpgrade kernel-toolsUpgrade kernel-abi-stablelistsUpgrade kernel | Oct 8, 2024 | Apr 2, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade kernel-toolsUpgrade kernelUpgrade python3-perfUpgrade kernel-tools-libs | Jul 17, 2024 | Apr 2, 2024 |
| Oracle_linux | — | Upgrade kernel | Aug 16, 2024 | Apr 2, 2024 |
| Redhat_linux | — | Upgrade kernelNo solution existsUpgrade kernel-rt | Aug 12, 2024 | Apr 2, 2024 |
| Rocky_linux | — | Upgrade kernel-rt-debug-modules-extraUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-rt-debug-develUpgrade kernel-rt-modulesUpgrade kernel-rtUpgrade kernel-tools-libs-develUpgrade kernel-headersUpgrade kernel-debug-modules-extraUpgrade kernel-toolsUpgrade perf-debuginfoUpgrade kernel-rt-debug-kvmUpgrade kernelUpgrade kernel-rt-debuginfoUpgrade kernel-modules-extraUpgrade kernel-develUpgrade kernel-tools-debuginfoUpgrade kernel-debug-coreUpgrade kernel-coreUpgrade bpftool-debuginfoUpgrade kernel-rt-debug-coreUpgrade kernel-rt-modules-extraUpgrade kernel-cross-headersUpgrade kernel-debug-develUpgrade kernel-rt-develUpgrade kernel-debuginfoUpgrade kernel-rt-debuginfo-common-x86_64Upgrade kernel-debug-modulesUpgrade kernel-rt-debug-debuginfoUpgrade perfUpgrade kernel-debug-debuginfoUpgrade kernel-debugUpgrade kernel-modulesUpgrade kernel-rt-debugUpgrade kernel-tools-libsUpgrade kernel-rt-kvmUpgrade python3-perf-debuginfoUpgrade kernel-rt-debug-modulesUpgrade kernel-rt-coreUpgrade bpftoolUpgrade python3-perf | Aug 22, 2024 | Apr 2, 2024 |
| Suse | — | Upgrade kernel-rt-develUpgrade dtb-qcomUpgrade reiserfs-kmp-azureUpgrade kernel-source-vanillaUpgrade kernel-rt-optionalUpgrade dtb-xilinxUpgrade kernel-rt-extraUpgrade dtb-mediatekUpgrade kernel-default-base-rebuildUpgrade kernel-rt-livepatchUpgrade dlm-kmp-defaultUpgrade kernel-rtUpgrade kernel-syms-rtUpgrade ocfs2-kmp-azureUpgrade dtb-rockchipUpgrade reiserfs-kmp-rtUpgrade dtb-renesasUpgrade kernel-64kb-extraUpgrade kernel-rt_debug-livepatch-develUpgrade gfs2-kmp-defaultUpgrade ocfs2-kmp-defaultUpgrade kselftests-kmp-defaultUpgrade kernel-devel-rtUpgrade dlm-kmp-rtUpgrade dtb-nvidiaUpgrade kernel-defaultUpgrade dtb-socionextUpgrade dtb-sprdUpgrade cluster-md-kmp-64kbUpgrade kernel-default-baseUpgrade kernel-default-livepatch-develUpgrade kernel-docsUpgrade kernel-rt_debug-vdsoUpgrade dtb-allwinnerUpgrade kernel-debug-vdsoUpgrade kernel-obs-buildUpgrade kernel-default-optionalUpgrade dtb-armUpgrade kernel-rt-vdsoUpgrade kernel-rt-livepatch-develUpgrade kselftests-kmp-rtUpgrade dlm-kmp-azureUpgrade kernel-azureUpgrade kernel-azure-vdsoUpgrade kernel-azure-develUpgrade dtb-marvellUpgrade gfs2-kmp-64kbUpgrade dtb-appleUpgrade kernel-64kbUpgrade dtb-amazonUpgrade kernel-kvmsmall-vdsoUpgrade kernel-kvmsmall-livepatch-develUpgrade reiserfs-kmp-defaultUpgrade kselftests-kmp-64kbUpgrade kernel-source-azureUpgrade gfs2-kmp-azureUpgrade dtb-apmUpgrade kernel-macrosUpgrade dtb-freescaleUpgrade kernel-default-vdsoUpgrade cluster-md-kmp-defaultUpgrade kernel-rt_debug-develUpgrade dtb-caviumUpgrade kernel-debug-livepatch-develUpgrade dtb-broadcomUpgrade kernel-azure-optionalUpgrade kernel-default-livepatchUpgrade kernel-64kb-livepatch-develUpgrade kernel-64kb-develUpgrade dtb-amdUpgrade cluster-md-kmp-azureUpgrade kernel-rt_debugUpgrade gfs2-kmp-rtUpgrade dtb-alteraUpgrade kernel-develUpgrade dtb-hisiliconUpgrade cluster-md-kmp-rtUpgrade kernel-symsUpgrade kselftests-kmp-azureUpgrade kernel-devel-azureUpgrade dtb-lgUpgrade kernel-docs-htmlUpgrade kernel-default-extraUpgrade dtb-amlogicUpgrade dlm-kmp-64kbUpgrade kernel-sourceUpgrade kernel-kvmsmall-develUpgrade kernel-syms-azureUpgrade reiserfs-kmp-64kbUpgrade ocfs2-kmp-rtUpgrade ocfs2-kmp-64kbUpgrade kernel-zfcpdumpUpgrade kernel-source-rtUpgrade kernel-obs-qaUpgrade kernel-debug-develUpgrade kernel-azure-livepatch-develUpgrade kernel-azure-extraUpgrade dtb-exynosUpgrade kernel-debugUpgrade kernel-kvmsmallUpgrade kernel-default-develUpgrade kernel-64kb-optional | Dec 5, 2025 | Sep 10, 2024 |
| Ubuntu | — | Upgrade linux-image-6.5.0-1022-gcpUpgrade linux-image-oracleUpgrade linux-image-oracle-lts-22.04Upgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-5.4.0-1140-azureUpgrade linux-image-5.15.0-1078-azureUpgrade linux-image-virtual-hwe-18.04Upgrade linux-image-5.15.0-1070-oracleUpgrade linux-image-generic-hwe-18.04Upgrade linux-image-6.5.0-1024-oracleUpgrade linux-image-oem-22.04dUpgrade linux-image-raspi-nolpaeUpgrade linux-image-gkeop-5.15Upgrade linux-image-azure-cvmUpgrade linux-image-raspi-hwe-18.04Upgrade linux-image-nvidia-lowlatencyUpgrade linux-image-5.4.0-1139-azureUpgrade linux-image-nvidia-64k-6.5Upgrade linux-image-5.4.0-1139-gcpUpgrade linux-image-azure-fdeUpgrade linux-image-bluefieldUpgrade linux-image-5.4.0-1094-bluefieldUpgrade linux-image-5.15.0-1038-xilinx-zynqmpUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-awsUpgrade linux-image-aws-lts-20.04Upgrade linux-image-5.4.0-1123-kvmUpgrade linux-image-generic-hwe-20.04Upgrade linux-image-laptop-23.10Upgrade linux-image-6.5.0-1024-oemUpgrade linux-image-5.4.0-1134-oracleUpgrade linux-image-gcp-lts-20.04Upgrade linux-image-kvmUpgrade linux-image-6.5.0-41-lowlatency-64kUpgrade linux-image-5.4.0-200-lowlatencyUpgrade linux-image-aws-lts-22.04Upgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-5.4.0-1119-raspiUpgrade linux-image-generic-hwe-22.04Upgrade linux-image-6.5.0-1021-awsUpgrade linux-image-raspi2Upgrade linux-image-5.15.0-1067-intel-iotgUpgrade linux-image-6.5.0-1018-raspiUpgrade linux-image-oem-22.04bUpgrade linux-image-oem-20.04dUpgrade linux-image-virtualUpgrade linux-image-oem-20.04cUpgrade linux-image-6.5.0-1015-starfiveUpgrade linux-image-ibm-lts-20.04Upgrade linux-image-5.15.0-1072-awsUpgrade linux-image-6.5.0-1021-nvidia-64kUpgrade linux-image-oracle-64kUpgrade linux-image-starfiveUpgrade linux-image-lowlatencyUpgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-5.15.0-1067-nvidiaUpgrade linux-image-oracle-lts-20.04Upgrade linux-image-6.5.0-1021-nvidiaUpgrade linux-image-6.5.0-41-genericUpgrade linux-image-5.4.0-1135-awsUpgrade linux-image-5.15.0-125-lowlatencyUpgrade linux-image-gcpUpgrade linux-image-azure-lts-20.04Upgrade linux-image-6.5.0-1022-azure-fdeUpgrade linux-image-intel-iotgUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-nvidia-6.5Upgrade linux-image-oem-20.04Upgrade linux-image-oem-22.04cUpgrade linux-image-5.4.0-200-generic-lpaeUpgrade linux-image-5.15.0-1075-azureUpgrade linux-image-oem-22.04aUpgrade linux-image-5.15.0-125-generic-64kUpgrade linux-image-6.5.0-1022-azureUpgrade linux-image-ibmUpgrade linux-image-oemUpgrade linux-image-azureUpgrade linux-image-nvidiaUpgrade linux-image-lowlatency-64kUpgrade linux-image-gcp-lts-22.04Upgrade linux-image-intelUpgrade linux-image-raspiUpgrade linux-image-gkeop-5.4Upgrade linux-image-5.15.0-1069-gkeUpgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-5.4.0-1054-xilinx-zynqmpUpgrade linux-image-5.15.0-1067-nvidia-lowlatencyUpgrade linux-image-5.15.0-1069-kvmUpgrade linux-image-snapdragon-hwe-18.04Upgrade linux-image-virtual-hwe-22.04Upgrade linux-image-oem-20.04bUpgrade linux-image-azure-lts-22.04Upgrade linux-image-generic-64kUpgrade linux-image-5.15.0-1065-raspiUpgrade linux-image-5.4.0-1044-iotUpgrade linux-image-6.5.0-1017-laptopUpgrade linux-image-gkeUpgrade linux-image-5.15.0-125-genericUpgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-5.15.0-1071-gcpUpgrade linux-image-5.4.0-1082-ibmUpgrade linux-image-lowlatency-hwe-18.04Upgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-gkeopUpgrade linux-image-5.4.0-1102-gkeopUpgrade linux-image-6.5.0-41-generic-64kUpgrade linux-image-oem-22.04Upgrade linux-image-5.15.0-125-lowlatency-64kUpgrade linux-image-virtual-hwe-20.04Upgrade linux-image-gke-5.15Upgrade linux-image-generic-lpaeUpgrade linux-image-6.5.0-1024-oracle-64kUpgrade linux-image-oem-osp1Upgrade linux-image-6.5.0-41-lowlatencyUpgrade linux-image-5.15.0-1055-gkeopUpgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-genericUpgrade linux-image-xilinx-zynqmpUpgrade linux-image-5.15.0-1065-ibmUpgrade linux-image-5.4.0-200-genericUpgrade linux-image-5.15.0-125-generic-lpae | May 17, 2024 | Apr 2, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jul 2, 2025 | Apr 2, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub