In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_tables: fix memleak in map from abort path
The delete set command does not rely on the transaction object for element removal, therefore, a combination of delete element + delete set from the abort path could result in restoring twice the refcount of the mapping.
Check for inactive element in the next generation for the delete element command in the abort path, skip restoring state if next generation bit has been already cleared. This is similar to the activate logic using the set walk iterator.
[ 6170.286929] ------------[ cut here ]------------ [ 6170.286939] WARNING: CPU: 6 PID: 790302 at net/netfilter/nf_tables_api.c:2086 nf_tables_chain_destroy+0x1f7/0x220 [nf_tables] [ 6170.287071] Modules linked in: [...] [ 6170.287633] CPU: 6 PID: 790302 Comm: kworker/6:2 Not tainted 6.9.0-rc3+ #365 [ 6170.287768] RIP: 0010:nf_tables_chain_destroy+0x1f7/0x220 [nf_tables] [ 6170.287886] Code: df 48 8d 7d 58 e8 69 2e 3b df 48 8b 7d 58 e8 80 1b 37 df 48 8d 7d 68 e8 57 2e 3b df 48 8b 7d 68 e8 6e 1b 37 df 48 89 ef eb c4 <0f> 0b 48 83 c4 08 5b 5d 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc 0f [ 6170.287895] RSP: 0018:ffff888134b8fd08 EFLAGS: 00010202 [ 6170.287904] RAX: 0000000000000001 RBX: ffff888125bffb28 RCX: dffffc0000000000 [ 6170.287912] RDX: 0000000000000003 RSI: ffffffffa20298ab RDI: ffff88811ebe4750 [ 6170.287919] RBP: ffff88811ebe4700 R08: ffff88838e812650 R09: fffffbfff0623a55 [ 6170.287926] R10: ffffffff8311d2af R11: 0000000000000001 R12: ffff888125bffb10 [ 6170.287933] R13: ffff888125bffb10 R14: dead000000000122 R15: dead000000000100 [ 6170.287940] FS: 0000000000000000(0000) GS:ffff888390b00000(0000) knlGS:0000000000000000 [ 6170.287948] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 6170.287955] CR2: 00007fd31fc00710 CR3: 0000000133f60004 CR4: 00000000001706f0 [ 6170.287962] Call Trace: [ 6170.287967] <TASK> [ 6170.287973] ? __warn+0x9f/0x1a0 [ 6170.287986] ? nf_tables_chain_destroy+0x1f7/0x220 [nf_tables] [ 6170.288092] ? report_bug+0x1b1/0x1e0 [ 6170.287986] ? nf_tables_chain_destroy+0x1f7/0x220 [nf_tables] [ 6170.288092] ? report_bug+0x1b1/0x1e0 [ 6170.288104] ? handle_bug+0x3c/0x70 [ 6170.288112] ? exc_invalid_op+0x17/0x40 [ 6170.288120] ? asm_exc_invalid_op+0x1a/0x20 [ 6170.288132] ? nf_tables_chain_destroy+0x2b/0x220 [nf_tables] [ 6170.288243] ? nf_tables_chain_destroy+0x1f7/0x220 [nf_tables] [ 6170.288366] ? nf_tables_chain_destroy+0x2b/0x220 [nf_tables] [ 6170.288483] nf_tables_trans_destroy_work+0x588/0x590 [nf_tables]
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-rt-debugUpgrade kernel-debug-coreUpgrade kernel-zfcpdump-coreUpgrade kernel-rt-debug-modulesUpgrade kernel-abi-stablelistsUpgrade kernelUpgrade kernel-rt-kvmUpgrade kernel-modules-extraUpgrade bpftoolUpgrade kernel-rt-debug-coreUpgrade kernel-rt-develUpgrade kernel-tools-libsUpgrade kernel-debug-modulesUpgrade kernel-zfcpdump-modulesUpgrade kernel-debug-modules-extraUpgrade kernel-rt-modules-extraUpgrade kernel-cross-headersUpgrade kernel-tools-libs-develUpgrade kernel-rt-debug-develUpgrade kernel-docUpgrade kernel-zfcpdumpUpgrade kernel-coreUpgrade kernel-zfcpdump-develUpgrade kernel-toolsUpgrade kernel-headersUpgrade kernel-rtUpgrade perfUpgrade python3-perfUpgrade kernel-debugUpgrade kernel-rt-coreUpgrade kernel-modulesUpgrade kernel-rt-debug-kvmUpgrade kernel-rt-modulesUpgrade kernel-develUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-debug-develUpgrade kernel-rt-debug-modules-extra | Aug 12, 2024 | May 1, 2024 |
| Debian | — | Upgrade linux | May 15, 2025 | May 1, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade kernelUpgrade kernel-tools-libsUpgrade kernel-abi-stablelistsUpgrade kernel-toolsUpgrade python3-perf | Jul 16, 2024 | May 1, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade kernel-abi-stablelistsUpgrade kernel-tools-libsUpgrade kernelUpgrade kernel-toolsUpgrade python3-perfUpgrade bpftool | Oct 8, 2024 | May 1, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade kernelUpgrade kernel-abi-stablelistsUpgrade python3-perfUpgrade kernel-toolsUpgrade kernel-tools-libsUpgrade bpftool | Oct 8, 2024 | May 1, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade kernelUpgrade kernel-tools-libsUpgrade python3-perfUpgrade kernel-tools | Jul 17, 2024 | May 1, 2024 |
| Oracle_linux | — | Upgrade kernel | Aug 16, 2024 | May 1, 2024 |
| Redhat_linux | — | Upgrade kernel-rtNo solution existsUpgrade kernel | Aug 12, 2024 | May 1, 2024 |
| Rocky_linux | — | Upgrade python3-perf-debuginfoUpgrade kernel-rt-modulesUpgrade kernel-toolsUpgrade kernel-rt-debug-debuginfoUpgrade kernel-rt-modules-extraUpgrade bpftoolUpgrade bpftool-debuginfoUpgrade kernel-tools-libs-develUpgrade kernel-rt-debuginfo-common-x86_64Upgrade perfUpgrade kernel-rt-kvmUpgrade kernel-develUpgrade kernel-rtUpgrade kernel-rt-develUpgrade kernel-tools-libsUpgrade python3-perfUpgrade kernel-debug-modulesUpgrade kernel-rt-debugUpgrade kernel-rt-debuginfoUpgrade kernel-debug-debuginfoUpgrade kernel-rt-debug-coreUpgrade kernel-debugUpgrade kernel-debuginfoUpgrade kernel-rt-coreUpgrade kernel-modulesUpgrade kernel-headersUpgrade kernel-rt-debug-modulesUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-rt-debug-develUpgrade kernel-modules-extraUpgrade kernel-rt-debug-kvmUpgrade kernel-tools-debuginfoUpgrade kernel-debug-coreUpgrade kernel-cross-headersUpgrade kernel-coreUpgrade kernel-debug-modules-extraUpgrade kernel-debug-develUpgrade kernelUpgrade perf-debuginfoUpgrade kernel-rt-debug-modules-extra | Aug 22, 2024 | May 1, 2024 |
| Suse | — | Upgrade kernel-64kb-optionalUpgrade kernel-debug-develUpgrade dtb-allwinnerUpgrade kernel-defaultUpgrade kernel-64kb-extraUpgrade kernel-rt-livepatchUpgrade dtb-renesasUpgrade cluster-md-kmp-rtUpgrade kernel-debugUpgrade cluster-md-kmp-64kbUpgrade dlm-kmp-64kbUpgrade dtb-caviumUpgrade kernel-source-azureUpgrade reiserfs-kmp-defaultUpgrade dtb-lgUpgrade gfs2-kmp-azureUpgrade gfs2-kmp-defaultUpgrade dtb-amdUpgrade kernel-default-baseUpgrade reiserfs-kmp-azureUpgrade dtb-alteraUpgrade kernel-default-develUpgrade ocfs2-kmp-defaultUpgrade dtb-mediatekUpgrade kernel-develUpgrade dtb-exynosUpgrade kernel-default-optionalUpgrade ocfs2-kmp-azureUpgrade kernel-64kb-livepatch-develUpgrade dtb-hisiliconUpgrade kernel-rt-develUpgrade kernel-default-livepatch-develUpgrade kernel-64kb-develUpgrade kernel-64kbUpgrade kernel-symsUpgrade dtb-armUpgrade kernel-rt_debug-livepatch-develUpgrade dtb-xilinxUpgrade dtb-sprdUpgrade kernel-azure-optionalUpgrade gfs2-kmp-64kbUpgrade kernel-default-vdsoUpgrade dlm-kmp-rtUpgrade kselftests-kmp-64kbUpgrade kernel-devel-rtUpgrade kernel-kvmsmallUpgrade kselftests-kmp-azureUpgrade kernel-kvmsmall-livepatch-develUpgrade dtb-qcomUpgrade kernel-docs-htmlUpgrade dtb-rockchipUpgrade ocfs2-kmp-rtUpgrade kernel-kvmsmall-vdsoUpgrade kernel-debug-vdsoUpgrade kernel-azure-develUpgrade dtb-marvellUpgrade kernel-source-vanillaUpgrade gfs2-kmp-rtUpgrade kernel-rt_debug-vdsoUpgrade kernel-obs-qaUpgrade kernel-azure-baseUpgrade kernel-azureUpgrade dtb-socionextUpgrade kernel-syms-rtUpgrade kernel-syms-azureUpgrade dtb-amazonUpgrade kernel-sourceUpgrade dlm-kmp-defaultUpgrade kernel-zfcpdumpUpgrade kernel-rt-optionalUpgrade kernel-rt-livepatch-develUpgrade kernel-obs-buildUpgrade kernel-devel-azureUpgrade kernel-debug-livepatch-develUpgrade dtb-amlogicUpgrade kernel-azure-vdsoUpgrade cluster-md-kmp-azureUpgrade kernel-rt_debugUpgrade reiserfs-kmp-rtUpgrade kernel-kvmsmall-develUpgrade kernel-default-manUpgrade dtb-broadcomUpgrade kernel-azure-livepatch-develUpgrade ocfs2-kmp-64kbUpgrade kernel-default-base-rebuildUpgrade kernel-azure-extraUpgrade kernel-source-rtUpgrade kernel-rt-extraUpgrade kernel-macrosUpgrade kernel-default-extraUpgrade cluster-md-kmp-defaultUpgrade dtb-appleUpgrade kselftests-kmp-rtUpgrade kernel-rtUpgrade kernel-rt-vdsoUpgrade dtb-freescaleUpgrade dtb-nvidiaUpgrade kernel-default-livepatchUpgrade kselftests-kmp-defaultUpgrade dlm-kmp-azureUpgrade kernel-docsUpgrade reiserfs-kmp-64kbUpgrade kernel-rt_debug-develUpgrade dtb-apm | Dec 5, 2025 | Sep 10, 2024 |
| Ubuntu | — | Upgrade linux-image-nvidiaUpgrade linux-image-gcpUpgrade linux-image-lowlatency-64kUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-genericUpgrade linux-image-6.8.0-38-lowlatency-64kUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-6.8.0-1008-ibmUpgrade linux-image-6.8.0-1006-gkeUpgrade linux-image-azure-fdeUpgrade linux-image-generic-64kUpgrade linux-image-6.8.0-38-generic-64kUpgrade linux-image-intelUpgrade linux-image-virtualUpgrade linux-image-oracleUpgrade linux-image-6.8.0-1009-nvidia-64kUpgrade linux-image-lowlatencyUpgrade linux-image-generic-lpaeUpgrade linux-image-6.8.0-1010-azure-fdeUpgrade linux-image-6.8.0-38-lowlatencyUpgrade linux-image-ibm-classicUpgrade linux-image-6.8.0-1007-intelUpgrade linux-image-6.8.0-1010-gcpUpgrade linux-image-6.8.0-1008-oracleUpgrade linux-image-6.8.0-1011-awsUpgrade linux-image-ibmUpgrade linux-image-6.8.0-1008-oracle-64kUpgrade linux-image-6.8.0-1008-oemUpgrade linux-image-oem-24.04aUpgrade linux-image-6.8.0-1010-azureUpgrade linux-image-oracle-64kUpgrade linux-image-6.8.0-1009-nvidiaUpgrade linux-image-awsUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-6.8.0-1007-raspiUpgrade linux-image-nvidia-64kUpgrade linux-image-kvmUpgrade linux-image-oem-24.04Upgrade linux-image-6.8.0-38-genericUpgrade linux-image-azureUpgrade linux-image-raspiUpgrade linux-image-gkeUpgrade linux-image-generic-hwe-24.04 | Jul 12, 2024 | May 1, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub