In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_tables: fix memleak in map from abort path
The delete set command does not rely on the transaction object for element removal, therefore, a combination of delete element + delete set from the abort path could result in restoring twice the refcount of the mapping.
Check for inactive element in the next generation for the delete element command in the abort path, skip restoring state if next generation bit has been already cleared. This is similar to the activate logic using the set walk iterator.
[ 6170.286929] ------------[ cut here ]------------ [ 6170.286939] WARNING: CPU: 6 PID: 790302 at net/netfilter/nf_tables_api.c:2086 nf_tables_chain_destroy+0x1f7/0x220 [nf_tables] [ 6170.287071] Modules linked in: [...] [ 6170.287633] CPU: 6 PID: 790302 Comm: kworker/6:2 Not tainted 6.9.0-rc3+ #365 [ 6170.287768] RIP: 0010:nf_tables_chain_destroy+0x1f7/0x220 [nf_tables] [ 6170.287886] Code: df 48 8d 7d 58 e8 69 2e 3b df 48 8b 7d 58 e8 80 1b 37 df 48 8d 7d 68 e8 57 2e 3b df 48 8b 7d 68 e8 6e 1b 37 df 48 89 ef eb c4 <0f> 0b 48 83 c4 08 5b 5d 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc 0f [ 6170.287895] RSP: 0018:ffff888134b8fd08 EFLAGS: 00010202 [ 6170.287904] RAX: 0000000000000001 RBX: ffff888125bffb28 RCX: dffffc0000000000 [ 6170.287912] RDX: 0000000000000003 RSI: ffffffffa20298ab RDI: ffff88811ebe4750 [ 6170.287919] RBP: ffff88811ebe4700 R08: ffff88838e812650 R09: fffffbfff0623a55 [ 6170.287926] R10: ffffffff8311d2af R11: 0000000000000001 R12: ffff888125bffb10 [ 6170.287933] R13: ffff888125bffb10 R14: dead000000000122 R15: dead000000000100 [ 6170.287940] FS: 0000000000000000(0000) GS:ffff888390b00000(0000) knlGS:0000000000000000 [ 6170.287948] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 6170.287955] CR2: 00007fd31fc00710 CR3: 0000000133f60004 CR4: 00000000001706f0 [ 6170.287962] Call Trace: [ 6170.287967] <TASK> [ 6170.287973] ? __warn+0x9f/0x1a0 [ 6170.287986] ? nf_tables_chain_destroy+0x1f7/0x220 [nf_tables] [ 6170.288092] ? report_bug+0x1b1/0x1e0 [ 6170.287986] ? nf_tables_chain_destroy+0x1f7/0x220 [nf_tables] [ 6170.288092] ? report_bug+0x1b1/0x1e0 [ 6170.288104] ? handle_bug+0x3c/0x70 [ 6170.288112] ? exc_invalid_op+0x17/0x40 [ 6170.288120] ? asm_exc_invalid_op+0x1a/0x20 [ 6170.288132] ? nf_tables_chain_destroy+0x2b/0x220 [nf_tables] [ 6170.288243] ? nf_tables_chain_destroy+0x1f7/0x220 [nf_tables] [ 6170.288366] ? nf_tables_chain_destroy+0x2b/0x220 [nf_tables] [ 6170.288483] nf_tables_trans_destroy_work+0x588/0x590 [nf_tables]
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-zfcpdumpUpgrade kernel-coreUpgrade kernel-rt-debug-kvmUpgrade kernel-rt-debug-develUpgrade kernel-headersUpgrade kernel-debugUpgrade kernel-zfcpdump-modules-extraUpgrade perfUpgrade kernel-develUpgrade kernel-docUpgrade kernel-modulesUpgrade kernel-debug-develUpgrade python3-perfUpgrade kernel-toolsUpgrade kernel-tools-libs-develUpgrade kernel-rtUpgrade kernel-rt-coreUpgrade kernel-rt-modulesUpgrade kernel-rt-debug-modules-extraUpgrade kernel-zfcpdump-develUpgrade kernel-cross-headersUpgrade kernel-debug-coreUpgrade kernel-tools-libsUpgrade kernelUpgrade kernel-rt-kvmUpgrade kernel-debug-modules-extraUpgrade kernel-zfcpdump-modulesUpgrade kernel-rt-debug-modulesUpgrade kernel-debug-modulesUpgrade kernel-abi-stablelistsUpgrade kernel-rt-debug-coreUpgrade kernel-rt-develUpgrade kernel-rt-modules-extraUpgrade kernel-zfcpdump-coreUpgrade kernel-modules-extraUpgrade bpftoolUpgrade kernel-rt-debug | Aug 12, 2024 | May 1, 2024 |
| Debian | — | Upgrade linuxNo solution exists | May 15, 2025 | May 1, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade kernel-tools-libsUpgrade kernel-abi-stablelistsUpgrade kernel-toolsUpgrade kernelUpgrade python3-perf | Jul 16, 2024 | May 1, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade kernel-tools-libsUpgrade kernelUpgrade kernel-abi-stablelistsUpgrade python3-perfUpgrade bpftoolUpgrade kernel-tools | Oct 8, 2024 | May 1, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade kernelUpgrade kernel-abi-stablelistsUpgrade python3-perfUpgrade kernel-tools-libsUpgrade bpftoolUpgrade kernel-tools | Oct 8, 2024 | May 1, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade kernel-toolsUpgrade python3-perfUpgrade kernel-tools-libsUpgrade kernel | Jul 17, 2024 | May 1, 2024 |
| Oracle_linux | — | Upgrade kernel | Aug 16, 2024 | May 1, 2024 |
| Redhat_linux | — | Upgrade kernel-rtNo solution existsUpgrade kernel | Aug 12, 2024 | May 1, 2024 |
| Rocky_linux | — | Upgrade kernel-rt-modules-extraUpgrade kernel-rt-debugUpgrade kernel-rt-develUpgrade perfUpgrade kernel-rt-kvmUpgrade kernel-tools-libs-develUpgrade bpftoolUpgrade bpftool-debuginfoUpgrade kernel-rt-debug-debuginfoUpgrade python3-perf-debuginfoUpgrade kernel-toolsUpgrade kernel-debug-debuginfoUpgrade kernel-rtUpgrade kernel-rt-debuginfoUpgrade kernel-rt-modulesUpgrade kernel-tools-libsUpgrade python3-perfUpgrade kernel-debug-modulesUpgrade kernel-develUpgrade kernel-rt-debug-coreUpgrade kernel-rt-debuginfo-common-x86_64Upgrade kernel-debug-modules-extraUpgrade kernel-debug-develUpgrade kernel-debuginfoUpgrade kernel-rt-coreUpgrade kernel-modulesUpgrade kernel-headersUpgrade kernel-debugUpgrade kernel-modules-extraUpgrade kernel-rt-debug-kvmUpgrade kernel-tools-debuginfoUpgrade kernel-debug-coreUpgrade kernel-cross-headersUpgrade kernel-rt-debug-develUpgrade kernel-coreUpgrade kernel-rt-debug-modulesUpgrade kernel-debuginfo-common-x86_64Upgrade kernelUpgrade kernel-rt-debug-modules-extraUpgrade perf-debuginfo | Aug 22, 2024 | May 1, 2024 |
| Suse | — | Upgrade dtb-alteraUpgrade dtb-amdUpgrade dtb-hisiliconUpgrade kernel-64kbUpgrade dtb-exynosUpgrade kernel-64kb-optionalUpgrade kernel-debug-develUpgrade dtb-renesasUpgrade kernel-default-livepatch-develUpgrade dlm-kmp-64kbUpgrade kernel-default-optionalUpgrade kernel-rt-livepatchUpgrade kernel-rt-develUpgrade kernel-azure-optionalUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-symsUpgrade dtb-allwinnerUpgrade kernel-64kb-extraUpgrade ocfs2-kmp-defaultUpgrade gfs2-kmp-defaultUpgrade dtb-lgUpgrade kernel-debugUpgrade kernel-default-baseUpgrade kernel-default-vdsoUpgrade cluster-md-kmp-64kbUpgrade cluster-md-kmp-rtUpgrade kernel-source-azureUpgrade kselftests-kmp-64kbUpgrade dlm-kmp-rtUpgrade kernel-devel-rtUpgrade dtb-xilinxUpgrade gfs2-kmp-64kbUpgrade gfs2-kmp-azureUpgrade kernel-default-develUpgrade ocfs2-kmp-azureUpgrade dtb-mediatekUpgrade kernel-64kb-livepatch-develUpgrade kernel-develUpgrade reiserfs-kmp-defaultUpgrade kernel-defaultUpgrade dtb-caviumUpgrade kernel-64kb-develUpgrade dtb-sprdUpgrade dtb-armUpgrade reiserfs-kmp-azureUpgrade dtb-freescaleUpgrade dtb-broadcomUpgrade dtb-socionextUpgrade kernel-obs-qaUpgrade dtb-nvidiaUpgrade kernel-default-livepatchUpgrade kernel-rt_debug-develUpgrade kernel-rt-vdsoUpgrade kernel-rt_debugUpgrade kernel-kvmsmall-develUpgrade gfs2-kmp-rtUpgrade dtb-marvellUpgrade kernel-source-vanillaUpgrade kernel-default-manUpgrade kernel-docsUpgrade kernel-azure-livepatch-develUpgrade dtb-apmUpgrade cluster-md-kmp-defaultUpgrade dtb-appleUpgrade kernel-azureUpgrade kernel-azure-baseUpgrade kselftests-kmp-defaultUpgrade kernel-syms-rtUpgrade kernel-syms-azureUpgrade reiserfs-kmp-rtUpgrade reiserfs-kmp-64kbUpgrade kselftests-kmp-rtUpgrade kernel-rt_debug-vdsoUpgrade kernel-rtUpgrade kernel-azure-vdsoUpgrade dtb-amlogicUpgrade cluster-md-kmp-azureUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-azure-extraUpgrade dlm-kmp-azureUpgrade ocfs2-kmp-64kbUpgrade kernel-source-rtUpgrade kernel-rt-extraUpgrade kernel-macrosUpgrade kernel-default-extraUpgrade kernel-default-base-rebuildUpgrade kernel-rt-optionalUpgrade kernel-sourceUpgrade kernel-rt-livepatch-develUpgrade kernel-obs-buildUpgrade kernel-devel-azureUpgrade kernel-debug-livepatch-develUpgrade dtb-amazonUpgrade kselftests-kmp-azureUpgrade kernel-zfcpdumpUpgrade dlm-kmp-defaultUpgrade ocfs2-kmp-rtUpgrade kernel-kvmsmall-vdsoUpgrade kernel-kvmsmallUpgrade kernel-docs-htmlUpgrade kernel-debug-vdsoUpgrade kernel-azure-develUpgrade dtb-rockchipUpgrade dtb-qcom | Dec 5, 2025 | Sep 10, 2024 |
| Ubuntu | — | Upgrade linux-image-azure-fdeUpgrade linux-image-gcpUpgrade linux-image-6.8.0-38-generic-64kUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-6.8.0-1008-ibmUpgrade linux-image-ibmUpgrade linux-image-6.8.0-1009-nvidia-64kUpgrade linux-image-nvidiaUpgrade linux-image-lowlatencyUpgrade linux-image-intelUpgrade linux-image-generic-lpaeUpgrade linux-image-genericUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-generic-64kUpgrade linux-image-6.8.0-38-lowlatency-64kUpgrade linux-image-lowlatency-64kUpgrade linux-image-6.8.0-1006-gkeUpgrade linux-image-oracleUpgrade linux-image-6.8.0-1010-azure-fdeUpgrade linux-image-virtualUpgrade linux-image-6.8.0-1008-oracleUpgrade linux-image-6.8.0-1010-gcpUpgrade linux-image-6.8.0-1008-oracle-64kUpgrade linux-image-ibm-classicUpgrade linux-image-6.8.0-1007-intelUpgrade linux-image-6.8.0-38-lowlatencyUpgrade linux-image-6.8.0-1011-awsUpgrade linux-image-raspiUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-6.8.0-38-genericUpgrade linux-image-kvmUpgrade linux-image-6.8.0-1008-oemUpgrade linux-image-oracle-64kUpgrade linux-image-awsUpgrade linux-image-nvidia-64kUpgrade linux-image-azureUpgrade linux-image-oem-24.04aUpgrade linux-image-6.8.0-1007-raspiUpgrade linux-image-oem-24.04Upgrade linux-image-6.8.0-1009-nvidiaUpgrade linux-image-gkeUpgrade linux-image-6.8.0-1010-azureUpgrade linux-image-generic-hwe-24.04 | Jul 12, 2024 | May 1, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub