In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_conntrack: fix crash due to removal of uninitialised entry
A crash in conntrack was reported while trying to unlink the conntrack entry from the hash bucket list: [exception RIP: __nf_ct_delete_from_lists+172] [..] #7 [ff539b5a2b043aa0] nf_ct_delete at ffffffffc124d421 [nf_conntrack] #8 [ff539b5a2b043ad0] nf_ct_gc_expired at ffffffffc124d999 [nf_conntrack] #9 [ff539b5a2b043ae0] __nf_conntrack_find_get at ffffffffc124efbc [nf_conntrack] [..]
The nf_conn struct is marked as allocated from slab but appears to be in a partially initialised state:
ct hlist pointer is garbage; looks like the ct hash value (hence crash). ct->status is equal to IPS_CONFIRMED|IPS_DYING, which is expected ct->timeout is 30000 (=30s), which is unexpected.
Everything else looks like normal udp conntrack entry. If we ignore ct->status and pretend its 0, the entry matches those that are newly allocated but not yet inserted into the hash: - ct hlist pointers are overloaded and store/cache the raw tuple hash - ct->timeout matches the relative time expected for a new udp flow rather than the absolute 'jiffies' value.
If it were not for the presence of IPS_CONFIRMED, __nf_conntrack_find_get() would have skipped the entry.
Theory is that we did hit following race:
cpu x cpu y cpu z found entry E found entry E E is expired <preemption> nf_ct_delete() return E to rcu slab init_conntrack E is re-inited, ct->status set to 0 reply tuplehash hnnode.pprev stores hash value.
cpu y found E right before it was deleted on cpu x. E is now re-inited on cpu z. cpu y was preempted before checking for expiry and/or confirm bit.
->refcnt set to 1 E now owned by skb ->timeout set to 30000
If cpu y were to resume now, it would observe E as expired but would skip E due to missing CONFIRMED bit.
nf_conntrack_confirm gets called sets: ct->status |= CONFIRMED This is wrong: E is not yet added to hashtable.
cpu y resumes, it observes E as expired but CONFIRMED: <resumes> nf_ct_expired() -> yes (ct->timeout is 30s) confirmed bit set.
cpu y will try to delete E from the hashtable: nf_ct_delete() -> set DYING bit __nf_ct_delete_from_lists
Even this scenario doesn't guarantee a crash: cpu z still holds the table bucket lock(s) so y blocks:
wait for spinlock held by z
CONFIRMED is set but there is no guarantee ct will be added to hash: "chaintoolong" or "clash resolution" logic both skip the insert step. reply hnnode.pprev still stores the hash value.
unlocks spinlock return NF_DROP <unblocks, then crashes on hlist_nulls_del_rcu pprev>
In case CPU z does insert the entry into the hashtable, cpu y will unlink E again right away but no crash occurs.
Without 'cpu y' race, 'garbage' hlist is of no consequence: ct refcnt remains at 1, eventually skb will be free'd and E gets destroyed via: nf_conntrack_put -> nf_conntrack_destroy -> nf_ct_destroy.
To resolve this, move the IPS_CONFIRMED assignment after the table insertion but before the unlock.
Pablo points out that the confirm-bit-store could be reordered to happen before hlist add resp. the timeout fixup, so switch to set_bit and before_atomic memory barrier to prevent this.
It doesn't matter if other CPUs can observe a newly inserted entry right before the CONFIRMED bit was set:
Such event cannot be distinguished from above "E is the old incarnation" case: the entry will be skipped.
Also change nf_ct_should_gc() to first check the confirmed bit.
The gc sequence is: 1. Check if entry has expired, if not skip to next entry 2. Obtain a reference to the expired entry. 3. Call nf_ct_should_gc() to double-check step 1.
nf_ct_should_gc() is thus called only for entries that already failed an expiry check. After this patch, once the confirmed bit check pas ---truncated---
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-docUpgrade kernel-rt-debug-modules-extraUpgrade kernel-zfcpdump-modulesUpgrade kernel-rt-64k-debug-modules-extraUpgrade python3-perfUpgrade kernel-uki-virt-addonsUpgrade kernel-rt-debug-develUpgrade kernel-headersUpgrade perfUpgrade kernel-64k-debugUpgrade kernel-rt-debug-modules-coreUpgrade kernel-tools-libs-develUpgrade rtlaUpgrade kernel-rt-64k-modules-extraUpgrade kernel-abi-stablelistsUpgrade kernel-rt-64k-debug-modulesUpgrade kernel-64k-coreUpgrade kernel-debug-devel-matchedUpgrade kernel-modules-coreUpgrade kernel-64k-devel-matchedUpgrade kernel-rt-64k-debug-coreUpgrade kernel-rt-64k-modulesUpgrade kernel-rt-debug-kvmUpgrade kernel-modulesUpgrade kernel-rt-modules-coreUpgrade kernel-debug-develUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-rt-modulesUpgrade kernel-64k-debug-modules-extraUpgrade kernel-zfcpdump-develUpgrade libperfUpgrade kernel-devel-matchedUpgrade kernel-zfcpdump-coreUpgrade kernel-uki-virtUpgrade kernel-zfcpdumpUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-rt-coreUpgrade kernelUpgrade kernel-64k-modulesUpgrade kernel-debug-coreUpgrade kernel-64k-modules-extraUpgrade kernel-rt-64k-coreUpgrade kernel-debugUpgrade kernel-rt-debug-coreUpgrade kernel-toolsUpgrade kernel-rt-64k-debug-develUpgrade kernel-64k-debug-modulesUpgrade kernel-64k-debug-develUpgrade kernel-rt-debug-modulesUpgrade kernel-cross-headersUpgrade kernel-rt-64k-debugUpgrade kernel-debug-modules-extraUpgrade kernel-64k-modules-coreUpgrade kernel-64k-debug-modules-coreUpgrade kernel-rt-64k-develUpgrade kernel-tools-libsUpgrade rvUpgrade kernel-modules-extraUpgrade kernel-debug-modules-coreUpgrade kernel-rt-64kUpgrade kernel-64kUpgrade kernel-debug-modulesUpgrade kernel-debug-uki-virtUpgrade kernel-64k-develUpgrade kernel-rt-64k-modules-coreUpgrade kernel-rt-64k-debug-modules-coreUpgrade kernel-64k-debug-devel-matchedUpgrade kernel-rt-develUpgrade kernel-rtUpgrade kernel-rt-modules-extraUpgrade kernel-rt-debugUpgrade kernel-develUpgrade kernel-coreUpgrade kernel-64k-debug-coreUpgrade kernel-rt-kvm | Oct 2, 2025 | Sep 29, 2025 |
| Amazon_linux_2023 | — | Upgrade perf6.12Upgrade kernel-debuginfo-common-aarch64Upgrade kernel-modules-extra-commonUpgrade bpftool-debuginfoUpgrade kernel6.12-libbpf-staticUpgrade kernel6.12-tools-debuginfoUpgrade python3-perf6.12-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade bpftoolUpgrade kernel6.12-libbpfUpgrade kernel6.12-libbpf-debuginfoUpgrade kernel6.12-libbpf-develUpgrade kernel-libbpf-staticUpgrade kernel-toolsUpgrade bpftool6.12Upgrade kernel-livepatch-6.1.147-172.266Upgrade kernel-libbpf-debuginfoUpgrade python3-perf-debuginfoUpgrade kernelUpgrade kernel6.12-tools-develUpgrade kernel6.12Upgrade kernel6.12-modules-extra-commonUpgrade python3-perfUpgrade kernel-libbpf-develUpgrade kernel-debuginfoUpgrade kernel6.12-debuginfo-common-x86_64Upgrade perfUpgrade kernel-headersUpgrade python3-perf6.12Upgrade kernel-tools-develUpgrade kernel6.12-headersUpgrade kernel6.12-develUpgrade kernel-modules-extraUpgrade perf6.12-debuginfoUpgrade kernel6.12-toolsUpgrade kernel-develUpgrade kernel6.12-debuginfoUpgrade kernel-tools-debuginfoUpgrade kernel6.12-debuginfo-common-aarch64Upgrade kernel6.12-modules-extraUpgrade kernel-livepatch-6.12.40-63.114Upgrade perf-debuginfoUpgrade bpftool6.12-debuginfoUpgrade kernel-libbpf | Sep 16, 2025 | Jul 28, 2025 |
| Debian | — | Upgrade linux-6.1Upgrade linux | Jul 31, 2025 | Jul 31, 2025 |
| Oracle_linux | — | Upgrade kernel | Sep 5, 2025 | Jul 28, 2025 |
| Redhat_linux | — | Upgrade kernelUpgrade kernel-rtNo solution exists | Jul 31, 2025 | Jul 28, 2025 |
| Rocky_linux | — | Upgrade kernel-rtUpgrade kernel-rt-modules-extraUpgrade kernel-rt-modulesUpgrade kernel-devel-matchedUpgrade kernel-tools-libs-develUpgrade kernel-zfcpdump-modulesUpgrade kernel-rt-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-rt-kvmUpgrade libperfUpgrade kernel-zfcpdump-coreUpgrade kernel-rt-modules-coreUpgrade kernel-debuginfo-common-s390xUpgrade kernel-toolsUpgrade kernel-rt-debug-coreUpgrade rvUpgrade kernel-debug-modules-extraUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-uki-virt-addonsUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-rt-debug-modules-coreUpgrade kernel-debug-devel-matchedUpgrade libperf-debuginfoUpgrade kernel-rt-debug-develUpgrade kernel-rt-debugUpgrade kernel-develUpgrade kernel-modulesUpgrade kernel-debug-develUpgrade kernel-coreUpgrade python3-perf-debuginfoUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-zfcpdump-debuginfoUpgrade kernel-rt-debug-modules-extraUpgrade kernel-tools-libsUpgrade python3-perfUpgrade perfUpgrade kernel-rt-debug-kvmUpgrade kernel-debug-debuginfoUpgrade perf-debuginfoUpgrade kernel-rt-develUpgrade kernel-rt-debug-debuginfoUpgrade kernel-debug-uki-virtUpgrade kernel-rt-coreUpgrade kernel-debugUpgrade rtlaUpgrade kernel-modules-extraUpgrade kernelUpgrade kernel-uki-virtUpgrade kernel-debug-coreUpgrade kernel-zfcpdump-develUpgrade kernel-modules-coreUpgrade kernel-debuginfoUpgrade kernel-debug-modules-coreUpgrade kernel-debug-modulesUpgrade kernel-zfcpdumpUpgrade kernel-tools-debuginfoUpgrade kernel-rt-debug-modules | Feb 5, 2026 | Oct 10, 2025 |
| Suse | — | Upgrade dtb-amdUpgrade kernel-kvmsmall-vdsoUpgrade kernel-rt-livepatch-develUpgrade kernel-defaultUpgrade reiserfs-kmp-defaultUpgrade ocfs2-kmp-azureUpgrade kselftests-kmp-rtUpgrade kernel-debugUpgrade kselftests-kmp-defaultUpgrade kernel-azure-vdsoUpgrade dtb-appleUpgrade gfs2-kmp-defaultUpgrade cluster-md-kmp-64kbUpgrade kernel-docs-htmlUpgrade dtb-hisiliconUpgrade cluster-md-kmp-defaultUpgrade dtb-marvellUpgrade kernel-default-baseUpgrade kernel-debug-develUpgrade dtb-renesasUpgrade kernel-docsUpgrade kernel-64kb-extraUpgrade dtb-armUpgrade kernel-debug-vdsoUpgrade kernel-default-livepatch-develUpgrade dlm-kmp-rtUpgrade kernel-obs-buildUpgrade kernel-rt-extraUpgrade kernel-rt_debug-vdsoUpgrade kernel-syms-rtUpgrade kernel-rt_debugUpgrade reiserfs-kmp-rtUpgrade dtb-sprdUpgrade kernel-rt-vdsoUpgrade dtb-broadcomUpgrade dtb-nvidiaUpgrade kernel-64kb-optionalUpgrade dlm-kmp-defaultUpgrade dlm-kmp-azureUpgrade dtb-socionextUpgrade dtb-amlogicUpgrade kernel-azure-extraUpgrade dtb-rockchipUpgrade kernel-obs-qaUpgrade kernel-default-develUpgrade dtb-alteraUpgrade dtb-exynosUpgrade kernel-zfcpdumpUpgrade kernel-sourceUpgrade kernel-rt_debug-develUpgrade dlm-kmp-64kbUpgrade ocfs2-kmp-defaultUpgrade kselftests-kmp-azureUpgrade kernel-symsUpgrade kernel-64kb-develUpgrade gfs2-kmp-rtUpgrade kselftests-kmp-64kbUpgrade kernel-source-vanillaUpgrade dtb-xilinxUpgrade kernel-rt-develUpgrade kernel-default-extraUpgrade kernel-azureUpgrade gfs2-kmp-azureUpgrade gfs2-kmp-64kbUpgrade dtb-qcomUpgrade dtb-freescaleUpgrade cluster-md-kmp-rtUpgrade kernel-develUpgrade kernel-macrosUpgrade kernel-devel-rtUpgrade kernel-kvmsmallUpgrade kernel-azure-develUpgrade kernel-devel-azureUpgrade kernel-default-optionalUpgrade dtb-lgUpgrade dtb-apmUpgrade reiserfs-kmp-64kbUpgrade kernel-default-base-rebuildUpgrade cluster-md-kmp-azureUpgrade ocfs2-kmp-rtUpgrade dtb-mediatekUpgrade kernel-syms-azureUpgrade kernel-default-vdsoUpgrade dtb-amazonUpgrade dtb-allwinnerUpgrade kernel-default-livepatchUpgrade kernel-azure-optionalUpgrade kernel-source-azureUpgrade kernel-rt-livepatchUpgrade dtb-caviumUpgrade reiserfs-kmp-azureUpgrade ocfs2-kmp-64kbUpgrade kernel-source-rtUpgrade kernel-64kbUpgrade kernel-rt-optionalUpgrade kernel-rtUpgrade kernel-kvmsmall-devel | Dec 5, 2025 | Sep 30, 2025 |
| Ubuntu | — | Upgrade linux-image-6.14.0-1017-azureUpgrade linux-image-6.8.0-1044-ibmUpgrade linux-image-6.8.0-1047-gcp-64kUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-gke-64kUpgrade linux-image-6.8.0-1023-xilinxUpgrade linux-image-lowlatency-6.8Upgrade linux-image-awsUpgrade linux-image-oracle-6.14Upgrade linux-image-raspiUpgrade linux-image-oem-22.04bUpgrade linux-image-azure-fipsUpgrade linux-image-6.8.0-100-generic-64kUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-6.14.0-1016-oemUpgrade linux-image-6.8.0-100-lowlatency-64kUpgrade linux-image-generic-64k-6.8Upgrade linux-image-aws-fipsUpgrade linux-image-raspi-6.8Upgrade linux-image-ibmUpgrade linux-image-6.14.0-1017-aws-64kUpgrade linux-image-generic-64k-6.14Upgrade linux-image-aws-lts-24.04Upgrade linux-image-azureUpgrade linux-image-aws-6.8Upgrade linux-image-generic-6.8Upgrade linux-image-realtime-6.8.1Upgrade linux-image-6.8.0-1046-awsUpgrade linux-image-6.8.0-1046-aws-fipsUpgrade linux-image-ibm-classicUpgrade linux-image-virtual-6.14Upgrade linux-image-6.8.0-100-lowlatencyUpgrade linux-image-oem-22.04aUpgrade linux-image-6.8.0-1043-oracle-64kUpgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-aws-6.14Upgrade linux-image-nvidia-64k-6.8Upgrade linux-image-azure-fips-6.8Upgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-generic-hwe-22.04Upgrade linux-image-gcp-64kUpgrade linux-image-6.14.0-1020-gcpUpgrade linux-image-aws-64k-6.8Upgrade linux-image-aws-64k-6.14Upgrade linux-image-6.8.0-1046-aws-64kUpgrade linux-image-6.14.0-36-generic-64kUpgrade linux-image-gcp-fipsUpgrade linux-image-aws-64k-lts-24.04Upgrade linux-image-kvmUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-6.14.0-1017-oracleUpgrade linux-image-6.14.0-1020-gcp-64kUpgrade linux-image-oracle-64k-6.8Upgrade linux-image-oracleUpgrade linux-image-gcp-6.8Upgrade linux-image-gcp-lts-24.04Upgrade linux-image-oem-6.14Upgrade linux-image-6.8.0-1046-nvidia-lowlatencyUpgrade linux-image-gcp-64k-6.14Upgrade linux-image-6.14.0-36-genericUpgrade linux-image-6.8.0-100-genericUpgrade linux-image-fips-6.8Upgrade linux-image-gkeop-6.8Upgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-azure-lts-24.04Upgrade linux-image-xilinx-6.8Upgrade linux-image-oracle-64k-6.14Upgrade linux-image-ibm-6.8Upgrade linux-image-oracle-6.8Upgrade linux-image-6.14.0-1017-oracle-64kUpgrade linux-image-6.8.0-1043-gke-64kUpgrade linux-image-generic-6.14Upgrade linux-image-aws-fips-6.8Upgrade linux-image-oracle-64k-lts-24.04Upgrade linux-image-virtual-6.8Upgrade linux-image-6.8.0-1047-gcp-fipsUpgrade linux-image-6.8.0-1047-raspiUpgrade linux-image-6.8.1-1041-realtimeUpgrade linux-image-azure-6.8Upgrade linux-image-oem-22.04cUpgrade linux-image-gke-64k-6.8Upgrade linux-image-6.8.0-1043-gkeUpgrade linux-image-nvidia-lowlatency-64k-6.8Upgrade linux-image-6.8.0-1047-gcpUpgrade linux-image-6.8.0-1046-nvidiaUpgrade linux-image-azure-6.14Upgrade linux-image-6.8.0-1051-azureUpgrade linux-image-genericUpgrade linux-image-oem-24.04aUpgrade linux-image-virtual-hwe-22.04Upgrade linux-image-raspi-6.14Upgrade linux-image-gkeopUpgrade linux-image-gke-6.8Upgrade linux-image-lowlatency-64kUpgrade linux-image-gcp-6.14Upgrade linux-image-nvidia-lowlatency-6.8Upgrade linux-image-intel-iot-realtimeUpgrade linux-image-6.8.0-2037-raspi-realtimeUpgrade linux-image-gcp-fips-6.8Upgrade linux-image-realtimeUpgrade linux-image-6.8.0-1046-nvidia-lowlatency-64kUpgrade linux-image-oracle-lts-24.04Upgrade linux-image-nvidia-6.8Upgrade linux-image-lowlatency-64k-6.8Upgrade linux-image-gcp-64k-lts-24.04Upgrade linux-image-6.14.0-1018-raspiUpgrade linux-image-realtime-6.14Upgrade linux-image-oem-22.04Upgrade linux-image-gcp-64k-6.8Upgrade linux-image-aws-64kUpgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-fipsUpgrade linux-image-6.8.0-1046-azureUpgrade linux-image-6.8.0-100-fipsUpgrade linux-image-6.14.0-1016-realtimeUpgrade linux-image-6.8.0-1046-azure-fipsUpgrade linux-image-nvidiaUpgrade linux-image-intel-iotgUpgrade linux-image-oem-22.04dUpgrade linux-image-6.14.0-1017-awsUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-6.8.0-1043-oracleUpgrade linux-image-generic-64kUpgrade linux-image-generic-lpaeUpgrade linux-image-realtime-hwe-22.04Upgrade linux-image-raspi-realtime-6.8Upgrade linux-image-oem-24.04Upgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-lowlatencyUpgrade linux-image-gkeUpgrade linux-image-6.8.0-1030-gkeopUpgrade linux-image-oracle-64kUpgrade linux-image-xilinxUpgrade linux-image-raspi-realtimeUpgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-6.8.0-1046-nvidia-64kUpgrade linux-image-xilinx-zynqmpUpgrade linux-image-virtualUpgrade linux-image-realtime-hwe-24.04Upgrade linux-image-gcpUpgrade linux-image-nvidia-64k | Jul 31, 2025 | Jul 28, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Aug 20, 2025 | Jul 28, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub