In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_tables: fix memleak in map from abort path
The delete set command does not rely on the transaction object for element removal, therefore, a combination of delete element + delete set from the abort path could result in restoring twice the refcount of the mapping.
Check for inactive element in the next generation for the delete element command in the abort path, skip restoring state if next generation bit has been already cleared. This is similar to the activate logic using the set walk iterator.
[ 6170.286929] ------------[ cut here ]------------ [ 6170.286939] WARNING: CPU: 6 PID: 790302 at net/netfilter/nf_tables_api.c:2086 nf_tables_chain_destroy+0x1f7/0x220 [nf_tables] [ 6170.287071] Modules linked in: [...] [ 6170.287633] CPU: 6 PID: 790302 Comm: kworker/6:2 Not tainted 6.9.0-rc3+ #365 [ 6170.287768] RIP: 0010:nf_tables_chain_destroy+0x1f7/0x220 [nf_tables] [ 6170.287886] Code: df 48 8d 7d 58 e8 69 2e 3b df 48 8b 7d 58 e8 80 1b 37 df 48 8d 7d 68 e8 57 2e 3b df 48 8b 7d 68 e8 6e 1b 37 df 48 89 ef eb c4 <0f> 0b 48 83 c4 08 5b 5d 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc 0f [ 6170.287895] RSP: 0018:ffff888134b8fd08 EFLAGS: 00010202 [ 6170.287904] RAX: 0000000000000001 RBX: ffff888125bffb28 RCX: dffffc0000000000 [ 6170.287912] RDX: 0000000000000003 RSI: ffffffffa20298ab RDI: ffff88811ebe4750 [ 6170.287919] RBP: ffff88811ebe4700 R08: ffff88838e812650 R09: fffffbfff0623a55 [ 6170.287926] R10: ffffffff8311d2af R11: 0000000000000001 R12: ffff888125bffb10 [ 6170.287933] R13: ffff888125bffb10 R14: dead000000000122 R15: dead000000000100 [ 6170.287940] FS: 0000000000000000(0000) GS:ffff888390b00000(0000) knlGS:0000000000000000 [ 6170.287948] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 6170.287955] CR2: 00007fd31fc00710 CR3: 0000000133f60004 CR4: 00000000001706f0 [ 6170.287962] Call Trace: [ 6170.287967] <TASK> [ 6170.287973] ? __warn+0x9f/0x1a0 [ 6170.287986] ? nf_tables_chain_destroy+0x1f7/0x220 [nf_tables] [ 6170.288092] ? report_bug+0x1b1/0x1e0 [ 6170.287986] ? nf_tables_chain_destroy+0x1f7/0x220 [nf_tables] [ 6170.288092] ? report_bug+0x1b1/0x1e0 [ 6170.288104] ? handle_bug+0x3c/0x70 [ 6170.288112] ? exc_invalid_op+0x17/0x40 [ 6170.288120] ? asm_exc_invalid_op+0x1a/0x20 [ 6170.288132] ? nf_tables_chain_destroy+0x2b/0x220 [nf_tables] [ 6170.288243] ? nf_tables_chain_destroy+0x1f7/0x220 [nf_tables] [ 6170.288366] ? nf_tables_chain_destroy+0x2b/0x220 [nf_tables] [ 6170.288483] nf_tables_trans_destroy_work+0x588/0x590 [nf_tables]
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-docUpgrade kernel-headersUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-debug-develUpgrade kernel-rt-debug-modules-extraUpgrade kernel-toolsUpgrade kernel-rtUpgrade kernel-develUpgrade kernel-modulesUpgrade kernel-rt-coreUpgrade kernel-zfcpdumpUpgrade kernel-rt-modulesUpgrade kernel-debugUpgrade kernel-rt-debug-develUpgrade kernel-tools-libs-develUpgrade perfUpgrade kernel-coreUpgrade kernel-rt-debug-kvmUpgrade python3-perfUpgrade kernel-zfcpdump-develUpgrade kernel-modules-extraUpgrade kernel-rt-kvmUpgrade kernel-zfcpdump-coreUpgrade kernel-tools-libsUpgrade kernel-rt-debugUpgrade kernel-abi-stablelistsUpgrade kernel-rt-debug-coreUpgrade kernel-rt-modules-extraUpgrade kernel-debug-modulesUpgrade kernel-rt-develUpgrade kernel-debug-modules-extraUpgrade kernel-zfcpdump-modulesUpgrade bpftoolUpgrade kernel-debug-coreUpgrade kernel-cross-headersUpgrade kernel-rt-debug-modulesUpgrade kernel | Aug 12, 2024 | May 1, 2024 |
| Debian | — | Upgrade linux | May 15, 2025 | May 1, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade python3-perfUpgrade kernel-tools-libsUpgrade kernel-toolsUpgrade kernel-abi-stablelistsUpgrade kernel | Jul 16, 2024 | May 1, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade kernelUpgrade kernel-abi-stablelistsUpgrade kernel-tools-libsUpgrade python3-perfUpgrade bpftoolUpgrade kernel-tools | Oct 8, 2024 | May 1, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade kernel-tools-libsUpgrade bpftoolUpgrade kernel-toolsUpgrade kernelUpgrade python3-perfUpgrade kernel-abi-stablelists | Oct 8, 2024 | May 1, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade kernelUpgrade kernel-tools-libsUpgrade python3-perfUpgrade kernel-tools | Jul 17, 2024 | May 1, 2024 |
| Oracle_linux | — | Upgrade kernel | Aug 16, 2024 | May 1, 2024 |
| Redhat_linux | — | Upgrade kernel-rtUpgrade kernelNo solution exists | Aug 12, 2024 | May 1, 2024 |
| Rocky_linux | — | Upgrade kernel-debugUpgrade kernel-rt-coreUpgrade kernelUpgrade kernel-debuginfoUpgrade kernel-rt-debug-develUpgrade kernel-modules-extraUpgrade kernel-rt-debug-kvmUpgrade kernel-rt-debug-modules-extraUpgrade kernel-debug-coreUpgrade kernel-tools-debuginfoUpgrade kernel-cross-headersUpgrade kernel-headersUpgrade kernel-rt-debug-modulesUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-modulesUpgrade kernel-debug-modules-extraUpgrade perf-debuginfoUpgrade kernel-coreUpgrade kernel-debug-develUpgrade kernel-develUpgrade python3-perfUpgrade kernel-debug-debuginfoUpgrade kernel-debug-modulesUpgrade kernel-rt-debugUpgrade kernel-tools-libsUpgrade kernel-rt-modulesUpgrade perfUpgrade kernel-tools-libs-develUpgrade kernel-rt-debuginfo-common-x86_64Upgrade kernel-rt-debug-coreUpgrade kernel-rtUpgrade kernel-rt-debuginfoUpgrade python3-perf-debuginfoUpgrade bpftool-debuginfoUpgrade kernel-rt-develUpgrade kernel-rt-debug-debuginfoUpgrade kernel-toolsUpgrade kernel-rt-modules-extraUpgrade kernel-rt-kvmUpgrade bpftool | Aug 22, 2024 | May 1, 2024 |
| Suse | — | Upgrade dtb-alteraUpgrade kernel-64kb-develUpgrade dtb-exynosUpgrade kernel-default-livepatch-develUpgrade dtb-hisiliconUpgrade kernel-rt-develUpgrade dtb-allwinnerUpgrade dtb-amdUpgrade kernel-64kbUpgrade reiserfs-kmp-azureUpgrade kernel-azure-optionalUpgrade ocfs2-kmp-azureUpgrade dlm-kmp-rtUpgrade kernel-devel-rtUpgrade kselftests-kmp-64kbUpgrade kernel-rt-livepatchUpgrade dtb-xilinxUpgrade kernel-default-optionalUpgrade gfs2-kmp-64kbUpgrade kernel-debug-develUpgrade kernel-defaultUpgrade kernel-default-vdsoUpgrade kernel-rt_debug-livepatch-develUpgrade dlm-kmp-64kbUpgrade kernel-symsUpgrade dtb-caviumUpgrade reiserfs-kmp-defaultUpgrade dtb-sprdUpgrade dtb-armUpgrade dtb-renesasUpgrade kernel-64kb-livepatch-develUpgrade gfs2-kmp-azureUpgrade kernel-source-azureUpgrade kernel-64kb-optionalUpgrade kernel-default-baseUpgrade ocfs2-kmp-defaultUpgrade kernel-default-develUpgrade kernel-develUpgrade kernel-64kb-extraUpgrade gfs2-kmp-defaultUpgrade dtb-mediatekUpgrade cluster-md-kmp-rtUpgrade cluster-md-kmp-64kbUpgrade dtb-lgUpgrade kernel-debugUpgrade kernel-rt-optionalUpgrade kernel-rtUpgrade dtb-apmUpgrade kernel-rt-livepatch-develUpgrade kselftests-kmp-azureUpgrade kernel-sourceUpgrade kernel-debug-livepatch-develUpgrade dtb-amazonUpgrade kernel-devel-azureUpgrade dlm-kmp-defaultUpgrade kernel-docs-htmlUpgrade kernel-syms-azureUpgrade kernel-azure-baseUpgrade dtb-socionextUpgrade kernel-azure-develUpgrade dtb-qcomUpgrade ocfs2-kmp-rtUpgrade kernel-kvmsmall-vdsoUpgrade kernel-kvmsmallUpgrade dtb-rockchipUpgrade reiserfs-kmp-rtUpgrade reiserfs-kmp-64kbUpgrade kernel-rt_debug-vdsoUpgrade kernel-azure-vdsoUpgrade dtb-amlogicUpgrade cluster-md-kmp-azureUpgrade kernel-default-livepatchUpgrade kernel-obs-qaUpgrade kernel-rt-vdsoUpgrade dtb-nvidiaUpgrade dtb-freescaleUpgrade kselftests-kmp-rtUpgrade kernel-rt_debug-develUpgrade dtb-broadcomUpgrade kselftests-kmp-defaultUpgrade kernel-azureUpgrade kernel-syms-rtUpgrade kernel-debug-vdsoUpgrade kernel-azure-extraUpgrade kernel-rt-extraUpgrade dlm-kmp-azureUpgrade ocfs2-kmp-64kbUpgrade kernel-source-rtUpgrade kernel-macrosUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-default-extraUpgrade kernel-default-base-rebuildUpgrade gfs2-kmp-rtUpgrade kernel-source-vanillaUpgrade kernel-kvmsmall-develUpgrade kernel-default-manUpgrade dtb-marvellUpgrade kernel-rt_debugUpgrade dtb-appleUpgrade cluster-md-kmp-defaultUpgrade kernel-docsUpgrade kernel-azure-livepatch-develUpgrade kernel-zfcpdumpUpgrade kernel-obs-build | Dec 5, 2025 | Sep 10, 2024 |
| Ubuntu | — | Upgrade linux-image-gkeUpgrade linux-image-raspiUpgrade linux-image-oem-24.04Upgrade linux-image-6.8.0-1010-azureUpgrade linux-image-6.8.0-38-genericUpgrade linux-image-6.8.0-1007-raspiUpgrade linux-image-kvmUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-6.8.0-1008-oemUpgrade linux-image-6.8.0-1009-nvidiaUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-oracle-64kUpgrade linux-image-azureUpgrade linux-image-oem-24.04aUpgrade linux-image-nvidia-64kUpgrade linux-image-awsUpgrade linux-image-ibm-classicUpgrade linux-image-lowlatency-64kUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-6.8.0-1008-ibmUpgrade linux-image-azure-fdeUpgrade linux-image-6.8.0-1007-intelUpgrade linux-image-nvidiaUpgrade linux-image-gcpUpgrade linux-image-6.8.0-38-generic-64kUpgrade linux-image-6.8.0-1008-oracleUpgrade linux-image-intelUpgrade linux-image-ibmUpgrade linux-image-oracleUpgrade linux-image-virtualUpgrade linux-image-6.8.0-38-lowlatency-64kUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-generic-lpaeUpgrade linux-image-6.8.0-1010-azure-fdeUpgrade linux-image-generic-64kUpgrade linux-image-6.8.0-1009-nvidia-64kUpgrade linux-image-lowlatencyUpgrade linux-image-6.8.0-1010-gcpUpgrade linux-image-6.8.0-1011-awsUpgrade linux-image-genericUpgrade linux-image-6.8.0-1008-oracle-64kUpgrade linux-image-6.8.0-1006-gkeUpgrade linux-image-6.8.0-38-lowlatency | Jul 12, 2024 | May 1, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub