In the Linux kernel, the following vulnerability has been resolved:
netfilter: br_netfilter: skip conntrack input hook for promisc packets
For historical reasons, when bridge device is in promisc mode, packets that are directed to the taps follow bridge input hook path. This patch adds a workaround to reset conntrack for these packets.
Jianbo Liu reports warning splats in their test infrastructure where cloned packets reach the br_netfilter input hook to confirm the conntrack object.
Scratch one bit from BR_INPUT_SKB_CB to annotate that this packet has reached the input hook because it is passed up to the bridge device to reach the taps.
[ 57.571874] WARNING: CPU: 1 PID: 0 at net/bridge/br_netfilter_hooks.c:616 br_nf_local_in+0x157/0x180 [br_netfilter] [ 57.572749] Modules linked in: xt_MASQUERADE nf_conntrack_netlink nfnetlink iptable_nat xt_addrtype xt_conntrack nf_nat br_netfilter rpcsec_gss_krb5 auth_rpcgss oid_registry overlay rpcrdma rdma_ucm ib_iser libiscsi scsi_transport_isc si ib_umad rdma_cm ib_ipoib iw_cm ib_cm mlx5_ib ib_uverbs ib_core mlx5ctl mlx5_core [ 57.575158] CPU: 1 PID: 0 Comm: swapper/1 Not tainted 6.8.0+ #19 [ 57.575700] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 [ 57.576662] RIP: 0010:br_nf_local_in+0x157/0x180 [br_netfilter] [ 57.577195] Code: fe ff ff 41 bd 04 00 00 00 be 04 00 00 00 e9 4a ff ff ff be 04 00 00 00 48 89 ef e8 f3 a9 3c e1 66 83 ad b4 00 00 00 04 eb 91 <0f> 0b e9 f1 fe ff ff 0f 0b e9 df fe ff ff 48 89 df e8 b3 53 47 e1 [ 57.578722] RSP: 0018:ffff88885f845a08 EFLAGS: 00010202 [ 57.579207] RAX: 0000000000000002 RBX: ffff88812dfe8000 RCX: 0000000000000000 [ 57.579830] RDX: ffff88885f845a60 RSI: ffff8881022dc300 RDI: 0000000000000000 [ 57.580454] RBP: ffff88885f845a60 R08: 0000000000000001 R09: 0000000000000003 [ 57.581076] R10: 00000000ffff1300 R11: 0000000000000002 R12: 0000000000000000 [ 57.581695] R13: ffff8881047ffe00 R14: ffff888108dbee00 R15: ffff88814519b800 [ 57.582313] FS: 0000000000000000(0000) GS:ffff88885f840000(0000) knlGS:0000000000000000 [ 57.583040] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 57.583564] CR2: 000000c4206aa000 CR3: 0000000103847001 CR4: 0000000000370eb0 [ 57.584194] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 57.584820] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 57.585440] Call Trace: [ 57.585721] <IRQ> [ 57.585976] ? __warn+0x7d/0x130 [ 57.586323] ? br_nf_local_in+0x157/0x180 [br_netfilter] [ 57.586811] ? report_bug+0xf1/0x1c0 [ 57.587177] ? handle_bug+0x3f/0x70 [ 57.587539] ? exc_invalid_op+0x13/0x60 [ 57.587929] ? asm_exc_invalid_op+0x16/0x20 [ 57.588336] ? br_nf_local_in+0x157/0x180 [br_netfilter] [ 57.588825] nf_hook_slow+0x3d/0xd0 [ 57.589188] ? br_handle_vlan+0x4b/0x110 [ 57.589579] br_pass_frame_up+0xfc/0x150 [ 57.589970] ? br_port_flags_change+0x40/0x40 [ 57.590396] br_handle_frame_finish+0x346/0x5e0 [ 57.590837] ? ipt_do_table+0x32e/0x430 [ 57.591221] ? br_handle_local_finish+0x20/0x20 [ 57.591656] br_nf_hook_thresh+0x4b/0xf0 [br_netfilter] [ 57.592286] ? br_handle_local_finish+0x20/0x20 [ 57.592802] br_nf_pre_routing_finish+0x178/0x480 [br_netfilter] [ 57.593348] ? br_handle_local_finish+0x20/0x20 [ 57.593782] ? nf_nat_ipv4_pre_routing+0x25/0x60 [nf_nat] [ 57.594279] br_nf_pre_routing+0x24c/0x550 [br_netfilter] [ 57.594780] ? br_nf_hook_thresh+0xf0/0xf0 [br_netfilter] [ 57.595280] br_handle_frame+0x1f3/0x3d0 [ 57.595676] ? br_handle_local_finish+0x20/0x20 [ 57.596118] ? br_handle_frame_finish+0x5e0/0x5e0 [ 57.596566] __netif_receive_skb_core+0x25b/0xfc0 [ 57.597017] ? __napi_build_skb+0x37/0x40 [ 57.597418] __netif_receive_skb_list_core+0xfb/0x220
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade kernel-debuginfo-common-aarch64Upgrade kernel-toolsUpgrade perf-debuginfoUpgrade bpftool-debuginfoUpgrade bpftoolUpgrade python-perfUpgrade perfUpgrade kernel-develUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-debuginfoUpgrade kernel-tools-debuginfoUpgrade python-perf-debuginfoUpgrade kernel-livepatch-5.15.158-103.164Upgrade kernelUpgrade kernel-tools-develUpgrade kernel-headers | Aug 14, 2024 | May 1, 2024 |
| Amazon_linux_2023 | — | Upgrade kernel-livepatch-6.1.90-99.173Upgrade kernel-modules-extraUpgrade kernel-toolsUpgrade kernel-tools-develUpgrade python3-perf-debuginfoUpgrade kernel-develUpgrade kernel-debuginfo-common-aarch64Upgrade python3-perfUpgrade bpftoolUpgrade perfUpgrade kernel-modules-extra-commonUpgrade kernel-tools-debuginfoUpgrade kernel-libbpf-staticUpgrade perf-debuginfoUpgrade kernel-libbpf-develUpgrade bpftool-debuginfoUpgrade kernel-debuginfoUpgrade kernel-headersUpgrade kernel-libbpfUpgrade kernel-debuginfo-common-x86_64Upgrade kernel | Feb 17, 2025 | May 1, 2024 |
| Debian | — | Upgrade linux | May 8, 2024 | May 1, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 1, 2024 |
| Suse | — | Upgrade kernel-azure-extraUpgrade dtb-amlogicUpgrade kernel-64kb-extraUpgrade kernel-azure-vdsoUpgrade reiserfs-kmp-64kbUpgrade kselftests-kmp-defaultUpgrade kernel-rt-optionalUpgrade dtb-broadcomUpgrade kernel-rt-vdsoUpgrade dlm-kmp-azureUpgrade cluster-md-kmp-64kbUpgrade reiserfs-kmp-defaultUpgrade kernel-debugUpgrade kernel-macrosUpgrade kernel-debug-develUpgrade cluster-md-kmp-defaultUpgrade dlm-kmp-defaultUpgrade kernel-64kb-optionalUpgrade kernel-docsUpgrade kernel-debug-vdsoUpgrade kernel-rt-extraUpgrade dtb-appleUpgrade kernel-docs-htmlUpgrade dtb-amdUpgrade dtb-apmUpgrade dtb-nvidiaUpgrade kernel-rt-livepatch-develUpgrade dlm-kmp-rtUpgrade kernel-symsUpgrade reiserfs-kmp-rtUpgrade kernel-rt_debug-vdsoUpgrade kernel-kvmsmall-vdsoUpgrade kernel-rt_debugUpgrade kernel-default-extraUpgrade kernel-defaultUpgrade ocfs2-kmp-azureUpgrade kernel-default-baseUpgrade dtb-armUpgrade gfs2-kmp-defaultUpgrade kselftests-kmp-rtUpgrade kernel-obs-qaUpgrade dtb-socionextUpgrade kernel-source-rtUpgrade kernel-default-livepatch-develUpgrade dtb-marvellUpgrade ocfs2-kmp-64kbUpgrade dtb-renesasUpgrade dtb-sprdUpgrade dtb-hisiliconUpgrade kernel-syms-rtUpgrade kernel-source-vanillaUpgrade dtb-rockchipUpgrade kselftests-kmp-azureUpgrade dtb-lgUpgrade dtb-mediatekUpgrade dtb-caviumUpgrade kernel-syms-azureUpgrade kernel-devel-rtUpgrade kernel-default-base-rebuildUpgrade reiserfs-kmp-azureUpgrade kernel-default-vdsoUpgrade dtb-xilinxUpgrade kernel-rt_debug-develUpgrade dtb-freescaleUpgrade dtb-amazonUpgrade cluster-md-kmp-rtUpgrade kernel-obs-buildUpgrade cluster-md-kmp-azureUpgrade kernel-zfcpdumpUpgrade kernel-default-optionalUpgrade kselftests-kmp-64kbUpgrade gfs2-kmp-azureUpgrade dtb-qcomUpgrade dtb-exynosUpgrade kernel-rt-develUpgrade kernel-develUpgrade kernel-default-livepatchUpgrade gfs2-kmp-rtUpgrade kernel-azure-develUpgrade gfs2-kmp-64kbUpgrade dtb-allwinnerUpgrade kernel-64kb-develUpgrade ocfs2-kmp-defaultUpgrade kernel-kvmsmall-develUpgrade kernel-azureUpgrade ocfs2-kmp-rtUpgrade kernel-rtUpgrade kernel-kvmsmallUpgrade dtb-alteraUpgrade kernel-devel-azureUpgrade dlm-kmp-64kbUpgrade kernel-default-develUpgrade kernel-source-azureUpgrade kernel-sourceUpgrade kernel-64kbUpgrade kernel-azure-optional | Dec 5, 2025 | May 21, 2025 |
| Ubuntu | — | Upgrade linux-image-raspiUpgrade linux-image-5.15.0-1060-nvidiaUpgrade linux-image-gcpUpgrade linux-image-5.15.0-1064-gcpUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-awsUpgrade linux-image-oem-24.04aUpgrade linux-image-5.15.0-1048-gkeopUpgrade linux-image-5.15.0-1065-awsUpgrade linux-image-5.15.0-1058-ibmUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-azure-fdeUpgrade linux-image-6.8.0-1008-ibmUpgrade linux-image-5.15.0-1062-gkeUpgrade linux-image-virtualUpgrade linux-image-oracleUpgrade linux-image-gkeop-5.15Upgrade linux-image-virtual-hwe-20.04Upgrade linux-image-6.8.0-1007-intelUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-5.15.0-1068-azure-fdeUpgrade linux-image-azure-fde-lts-22.04Upgrade linux-image-5.15.0-1035-xilinx-zynqmpUpgrade linux-image-6.8.0-38-genericUpgrade linux-image-5.15.0-116-lowlatencyUpgrade linux-image-5.15.0-116-generic-64kUpgrade linux-image-nvidia-64kUpgrade linux-image-oracle-64kUpgrade linux-image-ibm-classicUpgrade linux-image-6.8.0-1007-raspiUpgrade linux-image-5.15.0-1060-nvidia-lowlatencyUpgrade linux-image-oem-20.04cUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-6.8.0-1008-oemUpgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-oem-20.04dUpgrade linux-image-azure-cvmUpgrade linux-image-aws-lts-22.04Upgrade linux-image-generic-hwe-20.04Upgrade linux-image-5.15.0-116-genericUpgrade linux-image-kvmUpgrade linux-image-azureUpgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-6.8.0-1008-oracleUpgrade linux-image-5.15.0-1060-intel-iotgUpgrade linux-image-oem-24.04Upgrade linux-image-6.8.0-1010-azureUpgrade linux-image-generic-lpaeUpgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-gkeopUpgrade linux-image-ibmUpgrade linux-image-oem-20.04Upgrade linux-image-oracle-lts-22.04Upgrade linux-image-oem-20.04bUpgrade linux-image-6.8.0-1010-gcpUpgrade linux-image-xilinx-zynqmpUpgrade linux-image-azure-lts-22.04Upgrade linux-image-6.8.0-1009-nvidiaUpgrade linux-image-6.8.0-1009-nvidia-64kUpgrade linux-image-lowlatencyUpgrade linux-image-5.15.0-1068-azureUpgrade linux-image-generic-64kUpgrade linux-image-6.8.0-38-lowlatencyUpgrade linux-image-intel-iotgUpgrade linux-image-6.8.0-38-generic-64kUpgrade linux-image-gke-5.15Upgrade linux-image-genericUpgrade linux-image-6.8.0-1010-azure-fdeUpgrade linux-image-5.15.0-116-lowlatency-64kUpgrade linux-image-6.8.0-1008-oracle-64kUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-5.15.0-1062-kvmUpgrade linux-image-intelUpgrade linux-image-gkeUpgrade linux-image-6.8.0-1006-gkeUpgrade linux-image-6.8.0-38-lowlatency-64kUpgrade linux-image-5.15.0-1065-gcpUpgrade linux-image-5.15.0-1063-oracleUpgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-nvidiaUpgrade linux-image-lowlatency-64kUpgrade linux-image-gcp-lts-22.04Upgrade linux-image-6.8.0-1011-awsUpgrade linux-image-5.15.0-116-generic-lpae | Jul 12, 2024 | May 1, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | May 1, 2024 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub