In the Linux kernel, the following vulnerability has been resolved:
netfilter: br_netfilter: skip conntrack input hook for promisc packets
For historical reasons, when bridge device is in promisc mode, packets that are directed to the taps follow bridge input hook path. This patch adds a workaround to reset conntrack for these packets.
Jianbo Liu reports warning splats in their test infrastructure where cloned packets reach the br_netfilter input hook to confirm the conntrack object.
Scratch one bit from BR_INPUT_SKB_CB to annotate that this packet has reached the input hook because it is passed up to the bridge device to reach the taps.
[ 57.571874] WARNING: CPU: 1 PID: 0 at net/bridge/br_netfilter_hooks.c:616 br_nf_local_in+0x157/0x180 [br_netfilter] [ 57.572749] Modules linked in: xt_MASQUERADE nf_conntrack_netlink nfnetlink iptable_nat xt_addrtype xt_conntrack nf_nat br_netfilter rpcsec_gss_krb5 auth_rpcgss oid_registry overlay rpcrdma rdma_ucm ib_iser libiscsi scsi_transport_isc si ib_umad rdma_cm ib_ipoib iw_cm ib_cm mlx5_ib ib_uverbs ib_core mlx5ctl mlx5_core [ 57.575158] CPU: 1 PID: 0 Comm: swapper/1 Not tainted 6.8.0+ #19 [ 57.575700] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 [ 57.576662] RIP: 0010:br_nf_local_in+0x157/0x180 [br_netfilter] [ 57.577195] Code: fe ff ff 41 bd 04 00 00 00 be 04 00 00 00 e9 4a ff ff ff be 04 00 00 00 48 89 ef e8 f3 a9 3c e1 66 83 ad b4 00 00 00 04 eb 91 <0f> 0b e9 f1 fe ff ff 0f 0b e9 df fe ff ff 48 89 df e8 b3 53 47 e1 [ 57.578722] RSP: 0018:ffff88885f845a08 EFLAGS: 00010202 [ 57.579207] RAX: 0000000000000002 RBX: ffff88812dfe8000 RCX: 0000000000000000 [ 57.579830] RDX: ffff88885f845a60 RSI: ffff8881022dc300 RDI: 0000000000000000 [ 57.580454] RBP: ffff88885f845a60 R08: 0000000000000001 R09: 0000000000000003 [ 57.581076] R10: 00000000ffff1300 R11: 0000000000000002 R12: 0000000000000000 [ 57.581695] R13: ffff8881047ffe00 R14: ffff888108dbee00 R15: ffff88814519b800 [ 57.582313] FS: 0000000000000000(0000) GS:ffff88885f840000(0000) knlGS:0000000000000000 [ 57.583040] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 57.583564] CR2: 000000c4206aa000 CR3: 0000000103847001 CR4: 0000000000370eb0 [ 57.584194] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 57.584820] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 57.585440] Call Trace: [ 57.585721] <IRQ> [ 57.585976] ? __warn+0x7d/0x130 [ 57.586323] ? br_nf_local_in+0x157/0x180 [br_netfilter] [ 57.586811] ? report_bug+0xf1/0x1c0 [ 57.587177] ? handle_bug+0x3f/0x70 [ 57.587539] ? exc_invalid_op+0x13/0x60 [ 57.587929] ? asm_exc_invalid_op+0x16/0x20 [ 57.588336] ? br_nf_local_in+0x157/0x180 [br_netfilter] [ 57.588825] nf_hook_slow+0x3d/0xd0 [ 57.589188] ? br_handle_vlan+0x4b/0x110 [ 57.589579] br_pass_frame_up+0xfc/0x150 [ 57.589970] ? br_port_flags_change+0x40/0x40 [ 57.590396] br_handle_frame_finish+0x346/0x5e0 [ 57.590837] ? ipt_do_table+0x32e/0x430 [ 57.591221] ? br_handle_local_finish+0x20/0x20 [ 57.591656] br_nf_hook_thresh+0x4b/0xf0 [br_netfilter] [ 57.592286] ? br_handle_local_finish+0x20/0x20 [ 57.592802] br_nf_pre_routing_finish+0x178/0x480 [br_netfilter] [ 57.593348] ? br_handle_local_finish+0x20/0x20 [ 57.593782] ? nf_nat_ipv4_pre_routing+0x25/0x60 [nf_nat] [ 57.594279] br_nf_pre_routing+0x24c/0x550 [br_netfilter] [ 57.594780] ? br_nf_hook_thresh+0xf0/0xf0 [br_netfilter] [ 57.595280] br_handle_frame+0x1f3/0x3d0 [ 57.595676] ? br_handle_local_finish+0x20/0x20 [ 57.596118] ? br_handle_frame_finish+0x5e0/0x5e0 [ 57.596566] __netif_receive_skb_core+0x25b/0xfc0 [ 57.597017] ? __napi_build_skb+0x37/0x40 [ 57.597418] __netif_receive_skb_list_core+0xfb/0x220
CVSS Details
- CVSS 3.1 Base Score: 8.2
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade kernel-livepatch-5.15.158-103.164Upgrade kernel-headersUpgrade kernel-debuginfoUpgrade kernel-develUpgrade kernel-debuginfo-common-x86_64Upgrade kernelUpgrade kernel-tools-debuginfoUpgrade kernel-tools-develUpgrade python-perf-debuginfoUpgrade bpftool-debuginfoUpgrade python-perfUpgrade perfUpgrade kernel-toolsUpgrade perf-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade bpftool | Aug 14, 2024 | May 1, 2024 |
| Amazon_linux_2023 | — | Upgrade perfUpgrade kernel-libbpf-staticUpgrade kernel-tools-debuginfoUpgrade kernel-livepatch-6.1.90-99.173Upgrade kernel-modules-extra-commonUpgrade bpftoolUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-modules-extraUpgrade kernel-toolsUpgrade kernel-develUpgrade python3-perf-debuginfoUpgrade python3-perfUpgrade kernel-tools-develUpgrade kernel-debuginfoUpgrade kernel-headersUpgrade kernelUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-libbpfUpgrade bpftool-debuginfoUpgrade perf-debuginfoUpgrade kernel-libbpf-devel | Feb 17, 2025 | May 1, 2024 |
| Debian | — | Upgrade linux | May 8, 2024 | May 1, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 1, 2024 |
| Suse | — | Upgrade dtb-amdUpgrade kernel-kvmsmall-vdsoUpgrade kernel-docsUpgrade dtb-sprdUpgrade kernel-rt-optionalUpgrade cluster-md-kmp-64kbUpgrade kernel-debug-vdsoUpgrade dtb-apmUpgrade ocfs2-kmp-azureUpgrade kselftests-kmp-rtUpgrade dtb-armUpgrade kernel-rt-livepatch-develUpgrade dtb-appleUpgrade cluster-md-kmp-defaultUpgrade kernel-macrosUpgrade kernel-64kb-extraUpgrade kernel-rt_debug-vdsoUpgrade kernel-default-extraUpgrade kernel-rt-extraUpgrade kernel-debug-develUpgrade dtb-nvidiaUpgrade kernel-64kb-optionalUpgrade reiserfs-kmp-rtUpgrade dlm-kmp-defaultUpgrade kernel-syms-rtUpgrade reiserfs-kmp-64kbUpgrade dtb-renesasUpgrade kernel-docs-htmlUpgrade kernel-source-rtUpgrade kernel-rt-vdsoUpgrade kernel-default-baseUpgrade kselftests-kmp-defaultUpgrade dlm-kmp-azureUpgrade kernel-azure-extraUpgrade dtb-broadcomUpgrade kernel-symsUpgrade dtb-hisiliconUpgrade dlm-kmp-rtUpgrade ocfs2-kmp-64kbUpgrade dtb-socionextUpgrade kernel-default-livepatch-develUpgrade kernel-obs-qaUpgrade kernel-rt_debugUpgrade kernel-defaultUpgrade kernel-debugUpgrade gfs2-kmp-defaultUpgrade kernel-azure-vdsoUpgrade reiserfs-kmp-defaultUpgrade dtb-amlogicUpgrade dtb-marvellUpgrade kernel-64kb-develUpgrade dtb-lgUpgrade reiserfs-kmp-azureUpgrade kernel-rt-develUpgrade dlm-kmp-64kbUpgrade ocfs2-kmp-defaultUpgrade kernel-azureUpgrade kernel-kvmsmall-develUpgrade dtb-mediatekUpgrade kselftests-kmp-azureUpgrade kernel-default-vdsoUpgrade dtb-xilinxUpgrade dtb-rockchipUpgrade kernel-default-develUpgrade dtb-amazonUpgrade cluster-md-kmp-rtUpgrade dtb-caviumUpgrade kernel-default-optionalUpgrade gfs2-kmp-64kbUpgrade dtb-allwinnerUpgrade ocfs2-kmp-rtUpgrade kernel-sourceUpgrade kernel-kvmsmallUpgrade kernel-rt_debug-develUpgrade kernel-rtUpgrade kernel-obs-buildUpgrade dtb-alteraUpgrade cluster-md-kmp-azureUpgrade kernel-azure-optionalUpgrade kernel-syms-azureUpgrade kernel-source-vanillaUpgrade kernel-devel-rtUpgrade kernel-default-base-rebuildUpgrade kernel-64kbUpgrade kernel-azure-develUpgrade kernel-source-azureUpgrade gfs2-kmp-rtUpgrade kselftests-kmp-64kbUpgrade kernel-zfcpdumpUpgrade kernel-devel-azureUpgrade dtb-freescaleUpgrade gfs2-kmp-azureUpgrade dtb-qcomUpgrade dtb-exynosUpgrade kernel-develUpgrade kernel-default-livepatch | Dec 5, 2025 | May 21, 2025 |
| Ubuntu | — | Upgrade linux-image-6.8.0-1008-oracle-64kUpgrade linux-image-5.15.0-116-lowlatency-64kUpgrade linux-image-5.15.0-1065-gcpUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-5.15.0-1063-oracleUpgrade linux-image-6.8.0-1010-gcpUpgrade linux-image-6.8.0-1009-nvidia-64kUpgrade linux-image-intelUpgrade linux-image-6.8.0-38-lowlatency-64kUpgrade linux-image-5.15.0-116-generic-lpaeUpgrade linux-image-intel-iotgUpgrade linux-image-oracle-lts-22.04Upgrade linux-image-6.8.0-1010-azureUpgrade linux-image-5.15.0-1060-intel-iotgUpgrade linux-image-5.15.0-1062-kvmUpgrade linux-image-oem-20.04bUpgrade linux-image-6.8.0-1006-gkeUpgrade linux-image-5.15.0-1068-azureUpgrade linux-image-6.8.0-38-generic-64kUpgrade linux-image-gkeopUpgrade linux-image-generic-64kUpgrade linux-image-oem-24.04Upgrade linux-image-nvidiaUpgrade linux-image-6.8.0-1009-nvidiaUpgrade linux-image-generic-lpaeUpgrade linux-image-6.8.0-1010-azure-fdeUpgrade linux-image-lowlatency-64kUpgrade linux-image-6.8.0-1011-awsUpgrade linux-image-gcp-lts-22.04Upgrade linux-image-genericUpgrade linux-image-6.8.0-38-lowlatencyUpgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-gke-5.15Upgrade linux-image-gkeUpgrade linux-image-xilinx-zynqmpUpgrade linux-image-oem-20.04Upgrade linux-image-lowlatencyUpgrade linux-image-azure-lts-22.04Upgrade linux-image-ibmUpgrade linux-image-5.15.0-1062-gkeUpgrade linux-image-5.15.0-116-genericUpgrade linux-image-6.8.0-1008-oemUpgrade linux-image-oracleUpgrade linux-image-6.8.0-1008-ibmUpgrade linux-image-raspiUpgrade linux-image-gcpUpgrade linux-image-5.15.0-1064-gcpUpgrade linux-image-virtualUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-oem-24.04aUpgrade linux-image-awsUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-5.15.0-1060-nvidiaUpgrade linux-image-5.15.0-1035-xilinx-zynqmpUpgrade linux-image-5.15.0-116-lowlatencyUpgrade linux-image-6.8.0-38-genericUpgrade linux-image-aws-lts-22.04Upgrade linux-image-generic-hwe-20.04Upgrade linux-image-azureUpgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-oem-20.04dUpgrade linux-image-kvmUpgrade linux-image-6.8.0-1008-oracleUpgrade linux-image-virtual-hwe-20.04Upgrade linux-image-5.15.0-1060-nvidia-lowlatencyUpgrade linux-image-ibm-classicUpgrade linux-image-5.15.0-1058-ibmUpgrade linux-image-6.8.0-1007-raspiUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-5.15.0-1068-azure-fdeUpgrade linux-image-6.8.0-1007-intelUpgrade linux-image-azure-fde-lts-22.04Upgrade linux-image-virtual-hwe-24.04Upgrade linux-image-nvidia-64kUpgrade linux-image-gkeop-5.15Upgrade linux-image-azure-cvmUpgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-5.15.0-116-generic-64kUpgrade linux-image-oracle-64kUpgrade linux-image-oem-20.04cUpgrade linux-image-5.15.0-1048-gkeopUpgrade linux-image-5.15.0-1065-awsUpgrade linux-image-azure-fde | Jul 12, 2024 | May 1, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | May 1, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub