In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_tables: fix memleak in map from abort path
The delete set command does not rely on the transaction object for element removal, therefore, a combination of delete element + delete set from the abort path could result in restoring twice the refcount of the mapping.
Check for inactive element in the next generation for the delete element command in the abort path, skip restoring state if next generation bit has been already cleared. This is similar to the activate logic using the set walk iterator.
[ 6170.286929] ------------[ cut here ]------------ [ 6170.286939] WARNING: CPU: 6 PID: 790302 at net/netfilter/nf_tables_api.c:2086 nf_tables_chain_destroy+0x1f7/0x220 [nf_tables] [ 6170.287071] Modules linked in: [...] [ 6170.287633] CPU: 6 PID: 790302 Comm: kworker/6:2 Not tainted 6.9.0-rc3+ #365 [ 6170.287768] RIP: 0010:nf_tables_chain_destroy+0x1f7/0x220 [nf_tables] [ 6170.287886] Code: df 48 8d 7d 58 e8 69 2e 3b df 48 8b 7d 58 e8 80 1b 37 df 48 8d 7d 68 e8 57 2e 3b df 48 8b 7d 68 e8 6e 1b 37 df 48 89 ef eb c4 <0f> 0b 48 83 c4 08 5b 5d 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc 0f [ 6170.287895] RSP: 0018:ffff888134b8fd08 EFLAGS: 00010202 [ 6170.287904] RAX: 0000000000000001 RBX: ffff888125bffb28 RCX: dffffc0000000000 [ 6170.287912] RDX: 0000000000000003 RSI: ffffffffa20298ab RDI: ffff88811ebe4750 [ 6170.287919] RBP: ffff88811ebe4700 R08: ffff88838e812650 R09: fffffbfff0623a55 [ 6170.287926] R10: ffffffff8311d2af R11: 0000000000000001 R12: ffff888125bffb10 [ 6170.287933] R13: ffff888125bffb10 R14: dead000000000122 R15: dead000000000100 [ 6170.287940] FS: 0000000000000000(0000) GS:ffff888390b00000(0000) knlGS:0000000000000000 [ 6170.287948] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 6170.287955] CR2: 00007fd31fc00710 CR3: 0000000133f60004 CR4: 00000000001706f0 [ 6170.287962] Call Trace: [ 6170.287967] <TASK> [ 6170.287973] ? __warn+0x9f/0x1a0 [ 6170.287986] ? nf_tables_chain_destroy+0x1f7/0x220 [nf_tables] [ 6170.288092] ? report_bug+0x1b1/0x1e0 [ 6170.287986] ? nf_tables_chain_destroy+0x1f7/0x220 [nf_tables] [ 6170.288092] ? report_bug+0x1b1/0x1e0 [ 6170.288104] ? handle_bug+0x3c/0x70 [ 6170.288112] ? exc_invalid_op+0x17/0x40 [ 6170.288120] ? asm_exc_invalid_op+0x1a/0x20 [ 6170.288132] ? nf_tables_chain_destroy+0x2b/0x220 [nf_tables] [ 6170.288243] ? nf_tables_chain_destroy+0x1f7/0x220 [nf_tables] [ 6170.288366] ? nf_tables_chain_destroy+0x2b/0x220 [nf_tables] [ 6170.288483] nf_tables_trans_destroy_work+0x588/0x590 [nf_tables]
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-rt-debugUpgrade kernel-zfcpdump-modulesUpgrade kernelUpgrade kernel-debug-coreUpgrade kernel-rt-debug-coreUpgrade kernel-cross-headersUpgrade bpftoolUpgrade kernel-abi-stablelistsUpgrade kernel-debug-modules-extraUpgrade kernel-tools-libsUpgrade kernel-rt-modules-extraUpgrade kernel-rt-debug-modulesUpgrade kernel-debug-modulesUpgrade kernel-rt-kvmUpgrade kernel-rt-develUpgrade kernel-modules-extraUpgrade kernel-zfcpdump-coreUpgrade kernel-toolsUpgrade python3-perfUpgrade kernel-rt-modulesUpgrade kernel-rt-coreUpgrade kernel-modulesUpgrade kernel-rtUpgrade kernel-docUpgrade kernel-headersUpgrade kernel-tools-libs-develUpgrade kernel-rt-debug-kvmUpgrade kernel-zfcpdump-develUpgrade kernel-coreUpgrade kernel-zfcpdumpUpgrade perfUpgrade kernel-rt-debug-modules-extraUpgrade kernel-debug-develUpgrade kernel-rt-debug-develUpgrade kernel-debugUpgrade kernel-develUpgrade kernel-zfcpdump-modules-extra | Aug 12, 2024 | May 1, 2024 |
| Debian | — | Upgrade linuxNo solution exists | May 15, 2025 | May 1, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade python3-perfUpgrade kernel-toolsUpgrade kernelUpgrade kernel-tools-libsUpgrade kernel-abi-stablelists | Jul 16, 2024 | May 1, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade kernel-toolsUpgrade bpftoolUpgrade python3-perfUpgrade kernelUpgrade kernel-abi-stablelistsUpgrade kernel-tools-libs | Oct 8, 2024 | May 1, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade kernel-tools-libsUpgrade kernel-toolsUpgrade bpftoolUpgrade kernelUpgrade kernel-abi-stablelistsUpgrade python3-perf | Oct 8, 2024 | May 1, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade kernel-toolsUpgrade python3-perfUpgrade kernelUpgrade kernel-tools-libs | Jul 17, 2024 | May 1, 2024 |
| Oracle_linux | — | Upgrade kernel | Aug 16, 2024 | May 1, 2024 |
| Redhat_linux | — | Upgrade kernelNo solution existsUpgrade kernel-rt | Aug 12, 2024 | May 1, 2024 |
| Rocky_linux | — | Upgrade kernel-tools-libsUpgrade bpftoolUpgrade python3-perfUpgrade kernel-debug-modulesUpgrade kernel-rt-debug-coreUpgrade kernel-rt-develUpgrade python3-perf-debuginfoUpgrade kernel-rt-debug-debuginfoUpgrade perfUpgrade kernel-rt-modulesUpgrade kernel-tools-libs-develUpgrade kernel-rt-debugUpgrade kernel-rt-debuginfoUpgrade kernel-develUpgrade kernel-rt-debuginfo-common-x86_64Upgrade kernel-toolsUpgrade kernel-debug-debuginfoUpgrade kernel-rt-kvmUpgrade kernel-rt-modules-extraUpgrade kernel-rtUpgrade bpftool-debuginfoUpgrade kernel-coreUpgrade kernel-rt-debug-develUpgrade kernel-tools-debuginfoUpgrade kernel-modules-extraUpgrade kernel-rt-debug-kvmUpgrade perf-debuginfoUpgrade kernel-debuginfoUpgrade kernel-debug-modules-extraUpgrade kernel-debug-develUpgrade kernel-rt-coreUpgrade kernel-debug-coreUpgrade kernel-cross-headersUpgrade kernel-rt-debug-modulesUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-debugUpgrade kernel-headersUpgrade kernel-modulesUpgrade kernelUpgrade kernel-rt-debug-modules-extra | Aug 22, 2024 | May 1, 2024 |
| Suse | — | Upgrade kernel-64kbUpgrade dtb-exynosUpgrade reiserfs-kmp-azureUpgrade kernel-debug-develUpgrade dtb-hisiliconUpgrade kernel-defaultUpgrade kernel-default-optionalUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-symsUpgrade kernel-rt-develUpgrade kernel-azure-optionalUpgrade kernel-64kb-develUpgrade dtb-allwinnerUpgrade kernel-default-livepatch-develUpgrade dtb-sprdUpgrade ocfs2-kmp-azureUpgrade ocfs2-kmp-defaultUpgrade kernel-develUpgrade dtb-amdUpgrade kernel-rt-livepatchUpgrade dlm-kmp-64kbUpgrade reiserfs-kmp-defaultUpgrade gfs2-kmp-defaultUpgrade kernel-source-azureUpgrade dtb-lgUpgrade kernel-default-baseUpgrade kernel-default-develUpgrade gfs2-kmp-azureUpgrade dtb-mediatekUpgrade kernel-64kb-livepatch-develUpgrade cluster-md-kmp-64kbUpgrade dtb-caviumUpgrade dtb-renesasUpgrade kernel-64kb-optionalUpgrade kernel-64kb-extraUpgrade kernel-debugUpgrade cluster-md-kmp-rtUpgrade dtb-alteraUpgrade kernel-devel-rtUpgrade kselftests-kmp-64kbUpgrade dlm-kmp-rtUpgrade gfs2-kmp-64kbUpgrade kernel-default-vdsoUpgrade dtb-armUpgrade dtb-xilinxUpgrade ocfs2-kmp-64kbUpgrade kernel-rt-vdsoUpgrade kernel-kvmsmall-vdsoUpgrade kernel-kvmsmallUpgrade kernel-default-base-rebuildUpgrade kernel-source-rtUpgrade kernel-azure-extraUpgrade dlm-kmp-azureUpgrade kernel-rt-extraUpgrade kernel-macrosUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-default-extraUpgrade kernel-azure-baseUpgrade kernel-source-vanillaUpgrade kernel-docsUpgrade kernel-azure-livepatch-develUpgrade dtb-appleUpgrade dtb-apmUpgrade cluster-md-kmp-defaultUpgrade kernel-default-livepatchUpgrade dtb-nvidiaUpgrade dtb-freescaleUpgrade dtb-broadcomUpgrade kernel-obs-qaUpgrade kernel-rt_debug-develUpgrade dtb-amlogicUpgrade cluster-md-kmp-azureUpgrade reiserfs-kmp-rtUpgrade kselftests-kmp-rtUpgrade kernel-rt_debug-vdsoUpgrade kernel-rtUpgrade reiserfs-kmp-64kbUpgrade kernel-azure-vdsoUpgrade kernel-zfcpdumpUpgrade dtb-amazonUpgrade dlm-kmp-defaultUpgrade kselftests-kmp-azureUpgrade kernel-sourceUpgrade kernel-rt-optionalUpgrade kernel-rt-livepatch-develUpgrade kernel-devel-azureUpgrade kernel-debug-livepatch-develUpgrade kernel-obs-buildUpgrade kernel-syms-rtUpgrade kselftests-kmp-defaultUpgrade kernel-azureUpgrade dtb-socionextUpgrade gfs2-kmp-rtUpgrade kernel-default-manUpgrade dtb-marvellUpgrade kernel-kvmsmall-develUpgrade kernel-syms-azureUpgrade kernel-rt_debugUpgrade kernel-azure-develUpgrade dtb-rockchipUpgrade ocfs2-kmp-rtUpgrade kernel-docs-htmlUpgrade kernel-debug-vdsoUpgrade dtb-qcom | Dec 5, 2025 | Sep 10, 2024 |
| Ubuntu | — | Upgrade linux-image-genericUpgrade linux-image-virtualUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-6.8.0-1010-azure-fdeUpgrade linux-image-intelUpgrade linux-image-ibmUpgrade linux-image-nvidiaUpgrade linux-image-lowlatencyUpgrade linux-image-6.8.0-1009-nvidia-64kUpgrade linux-image-generic-64kUpgrade linux-image-lowlatency-64kUpgrade linux-image-6.8.0-38-lowlatency-64kUpgrade linux-image-6.8.0-38-generic-64kUpgrade linux-image-6.8.0-1011-awsUpgrade linux-image-oracleUpgrade linux-image-6.8.0-1006-gkeUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-6.8.0-1008-ibmUpgrade linux-image-6.8.0-1008-oracle-64kUpgrade linux-image-azure-fdeUpgrade linux-image-6.8.0-1008-oracleUpgrade linux-image-gcpUpgrade linux-image-ibm-classicUpgrade linux-image-6.8.0-38-lowlatencyUpgrade linux-image-6.8.0-1010-gcpUpgrade linux-image-6.8.0-1007-intelUpgrade linux-image-generic-lpaeUpgrade linux-image-6.8.0-1009-nvidiaUpgrade linux-image-6.8.0-1008-oemUpgrade linux-image-oracle-64kUpgrade linux-image-6.8.0-1007-raspiUpgrade linux-image-nvidia-64kUpgrade linux-image-gkeUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-azureUpgrade linux-image-oem-24.04aUpgrade linux-image-raspiUpgrade linux-image-kvmUpgrade linux-image-oem-24.04Upgrade linux-image-6.8.0-1010-azureUpgrade linux-image-6.8.0-38-genericUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-aws | Jul 12, 2024 | May 1, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub