In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_reject: don't leak dst refcount for loopback packets
recent patches to add a WARN() when replacing skb dst entry found an old bug:
WARNING: include/linux/skbuff.h:1165 skb_dst_check_unset include/linux/skbuff.h:1164 [inline] WARNING: include/linux/skbuff.h:1165 skb_dst_set include/linux/skbuff.h:1210 [inline] WARNING: include/linux/skbuff.h:1165 nf_reject_fill_skb_dst+0x2a4/0x330 net/ipv4/netfilter/nf_reject_ipv4.c:234 [..] Call Trace: nf_send_unreach+0x17b/0x6e0 net/ipv4/netfilter/nf_reject_ipv4.c:325 nft_reject_inet_eval+0x4bc/0x690 net/netfilter/nft_reject_inet.c:27 expr_call_ops_eval net/netfilter/nf_tables_core.c:237 [inline] ..
This is because blamed commit forgot about loopback packets. Such packets already have a dst_entry attached, even at PRE_ROUTING stage.
Instead of checking hook just check if the skb already has a route attached to it.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade kernel-debuginfo-common-aarch64Upgrade perf-debuginfoUpgrade kernel-develUpgrade perfUpgrade kernel-tools-develUpgrade kernelUpgrade kernel-debuginfoUpgrade kernel-livepatch-5.10.242-239.961Upgrade kernel-tools-debuginfoUpgrade kernel-toolsUpgrade kernel-livepatch-5.15.191-132.213Upgrade kernel-headersUpgrade bpftool-debuginfoUpgrade python-perf-debuginfoUpgrade bpftoolUpgrade python-perfUpgrade kernel-debuginfo-common-x86_64 | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade kernelUpgrade kernel6.12-tools-debuginfoUpgrade bpftool6.12Upgrade kernel6.12-modules-extra-commonUpgrade kernel6.12-libbpf-develUpgrade kernel6.12-debuginfoUpgrade perf6.12Upgrade kernel6.12-libbpf-staticUpgrade kernel6.12-libbpfUpgrade perf-debuginfoUpgrade bpftool6.12-debuginfoUpgrade kernel-livepatch-6.1.150-174.273Upgrade bpftool-debuginfoUpgrade python3-perf6.12-debuginfoUpgrade kernel-libbpf-develUpgrade kernel6.12-debuginfo-common-aarch64Upgrade kernel-toolsUpgrade kernel-modules-extra-commonUpgrade kernel-headersUpgrade kernel-libbpf-staticUpgrade kernel-debuginfo-common-x86_64Upgrade kernel6.12-modules-extraUpgrade perfUpgrade kernel6.12-toolsUpgrade kernel-tools-develUpgrade kernel-modules-extraUpgrade kernel-debuginfoUpgrade perf6.12-debuginfoUpgrade kernel-livepatch-6.12.46-66.121Upgrade kernel-debuginfo-common-aarch64Upgrade kernel-tools-debuginfoUpgrade kernel-libbpf-debuginfoUpgrade bpftoolUpgrade python3-perfUpgrade kernel-develUpgrade python3-perf6.12Upgrade kernel6.12-libbpf-debuginfoUpgrade kernel6.12-develUpgrade kernel-libbpfUpgrade kernel6.12-tools-develUpgrade kernel6.12-debuginfo-common-x86_64Upgrade kernel6.12-headersUpgrade kernel6.12Upgrade python3-perf-debuginfo | Sep 30, 2025 | Sep 5, 2025 |
| Debian | — | Upgrade linuxUpgrade linux-6.1 | Sep 25, 2025 | Sep 25, 2025 |
| Huawei Euleros 2_0_sp12 | — | Upgrade bpftoolUpgrade python3-perfUpgrade kernel-toolsUpgrade kernel-tools-libsUpgrade kernelUpgrade kernel-abi-stablelists | Mar 17, 2026 | Mar 16, 2026 |
| Huawei Euleros 2_0_sp13 | — | Upgrade bpftoolUpgrade python3-perfUpgrade kernel-tools-libsUpgrade kernel-toolsUpgrade kernel-abi-stablelistsUpgrade kernel | Mar 10, 2026 | Mar 10, 2026 |
| Oracle_linux | — | Upgrade kernel-uek | Nov 11, 2025 | Sep 5, 2025 |
| Redhat_linux | — | No solution exists | Jul 17, 2026 | Sep 5, 2025 |
| Suse | — | Upgrade kernel-develUpgrade kselftests-kmp-64kbUpgrade dtb-armUpgrade reiserfs-kmp-azureUpgrade dtb-sprdUpgrade kernel-rt-extraUpgrade kernel-rt-develUpgrade kernel-kvmsmallUpgrade kernel-syms-azureUpgrade dtb-rockchipUpgrade kernel-azure-optionalUpgrade kernel-default-optionalUpgrade dtb-mediatekUpgrade dtb-nvidiaUpgrade kernel-rtUpgrade kernel-rt-livepatchUpgrade dtb-qcomUpgrade gfs2-kmp-azureUpgrade kernel-devel-azureUpgrade kernel-default-base-rebuildUpgrade cluster-md-kmp-rtUpgrade dtb-allwinnerUpgrade ocfs2-kmp-azureUpgrade gfs2-kmp-rtUpgrade ocfs2-kmp-defaultUpgrade dlm-kmp-64kbUpgrade dtb-caviumUpgrade dtb-exynosUpgrade kernel-64kb-develUpgrade kernel-default-vdsoUpgrade cluster-md-kmp-64kbUpgrade kernel-devel-rtUpgrade kernel-azure-develUpgrade dtb-xilinxUpgrade kernel-obs-buildUpgrade dtb-alteraUpgrade kernel-sourceUpgrade kernel-source-rtUpgrade kernel-zfcpdumpUpgrade kernel-rt_debug-develUpgrade kernel-macrosUpgrade kernel-source-vanillaUpgrade kernel-debugUpgrade dtb-marvellUpgrade dtb-freescaleUpgrade kernel-debug-develUpgrade dtb-amdUpgrade cluster-md-kmp-azureUpgrade ocfs2-kmp-64kbUpgrade kernel-default-livepatch-develUpgrade dtb-amazonUpgrade dlm-kmp-defaultUpgrade kernel-azure-vdsoUpgrade kernel-64kbUpgrade kernel-defaultUpgrade kernel-debug-vdsoUpgrade reiserfs-kmp-defaultUpgrade reiserfs-kmp-64kbUpgrade ocfs2-kmp-rtUpgrade kselftests-kmp-rtUpgrade kernel-syms-rtUpgrade kernel-symsUpgrade kernel-rt-vdsoUpgrade kernel-rt-optionalUpgrade kernel-docs-htmlUpgrade kernel-docsUpgrade kernel-azureUpgrade gfs2-kmp-64kbUpgrade kernel-64kb-optionalUpgrade dtb-lgUpgrade kernel-default-extraUpgrade kernel-rt_debugUpgrade kernel-rt-livepatch-develUpgrade kernel-default-livepatchUpgrade dtb-appleUpgrade kernel-kvmsmall-vdsoUpgrade dlm-kmp-azureUpgrade cluster-md-kmp-defaultUpgrade kernel-kvmsmall-develUpgrade dlm-kmp-rtUpgrade kernel-source-azureUpgrade kernel-rt_debug-vdsoUpgrade kernel-obs-qaUpgrade kernel-default-baseUpgrade kernel-64kb-extraUpgrade dtb-hisiliconUpgrade dtb-amlogicUpgrade kselftests-kmp-azureUpgrade gfs2-kmp-defaultUpgrade dtb-apmUpgrade dtb-renesasUpgrade kernel-default-develUpgrade reiserfs-kmp-rtUpgrade kselftests-kmp-defaultUpgrade dtb-socionextUpgrade kernel-azure-extraUpgrade dtb-broadcom | Dec 5, 2025 | Oct 15, 2025 |
| Ubuntu | — | Upgrade linux-image-5.15.0-1097-gcp-fipsUpgrade linux-image-gke-5.15Upgrade linux-image-gke-6.8Upgrade linux-image-intelUpgrade linux-image-oem-20.04Upgrade linux-image-oem-20.04cUpgrade linux-image-lowlatency-5.15Upgrade linux-image-oracle-64k-6.8Upgrade linux-image-generic-lpae-5.15Upgrade linux-image-intel-iotgUpgrade linux-image-5.15.0-1101-azure-fipsUpgrade linux-image-azure-6.8Upgrade linux-image-genericUpgrade linux-image-5.15.0-1102-azureUpgrade linux-image-lowlatency-64k-6.8Upgrade linux-image-oem-22.04aUpgrade linux-image-5.15.0-1097-awsUpgrade linux-image-5.15.0-1089-kvmUpgrade linux-image-azureUpgrade linux-image-nvidia-tegra-rt-5.15Upgrade linux-image-6.8.0-1046-nvidia-lowlatency-64kUpgrade linux-image-oracle-lts-24.04Upgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-6.8.0-1044-ibmUpgrade linux-image-5.15.0-1091-raspiUpgrade linux-image-aws-64kUpgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-gcp-64k-6.8Upgrade linux-image-realtime-hwe-22.04Upgrade linux-image-5.15.0-1097-aws-fipsUpgrade linux-image-gkeop-6.8Upgrade linux-image-lowlatencyUpgrade linux-image-gcp-lts-22.04Upgrade linux-image-intel-iotg-5.15Upgrade linux-image-azure-lts-22.04Upgrade linux-image-oem-20.04bUpgrade linux-image-aws-5.15Upgrade linux-image-6.8.0-1046-awsUpgrade linux-image-ibm-5.15Upgrade linux-image-xilinx-zynqmpUpgrade linux-image-generic-5.15Upgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-gcp-fips-5.15Upgrade linux-image-aws-fipsUpgrade linux-image-fipsUpgrade linux-image-gkeopUpgrade linux-image-nvidia-tegra-igx-5.15Upgrade linux-image-lowlatency-64kUpgrade linux-image-intel-iot-realtimeUpgrade linux-image-6.8.0-1023-xilinxUpgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-nvidia-tegra-rtUpgrade linux-image-nvidia-tegraUpgrade linux-image-5.15.0-1038-nvidia-tegra-igxUpgrade linux-image-6.8.0-1051-azureUpgrade linux-image-virtual-hwe-22.04Upgrade linux-image-aws-fips-5.15Upgrade linux-image-oem-22.04cUpgrade linux-image-6.8.0-100-generic-64kUpgrade linux-image-6.8.0-1043-gkeUpgrade linux-image-aws-64k-lts-22.04Upgrade linux-image-6.8.0-1046-azureUpgrade linux-image-nvidia-lowlatency-64k-6.8Upgrade linux-image-5.15.0-1049-nvidia-tegra-rtUpgrade linux-image-lowlatency-6.8Upgrade linux-image-raspiUpgrade linux-image-gcp-fips-6.8Upgrade linux-image-ibmUpgrade linux-image-5.15.0-163-genericUpgrade linux-image-5.15.0-163-generic-lpaeUpgrade linux-image-oracle-lts-22.04Upgrade linux-image-kvm-5.15Upgrade linux-image-nvidia-tegra-5.15Upgrade linux-image-gcp-64kUpgrade linux-image-6.8.0-1047-gcpUpgrade linux-image-gcp-64k-lts-24.04Upgrade linux-image-nvidia-lowlatency-5.15Upgrade linux-image-nvidiaUpgrade linux-image-azure-fips-5.15Upgrade linux-image-nvidia-lowlatency-6.8Upgrade linux-image-nvidia-tegra-igx-rt-5.15Upgrade linux-image-5.15.0-1061-xilinx-zynqmpUpgrade linux-image-5.15.0-1096-realtimeUpgrade linux-image-generic-lpaeUpgrade linux-image-generic-64kUpgrade linux-image-5.15.0-1092-intel-iotgUpgrade linux-image-nvidia-6.8Upgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-aws-6.8Upgrade linux-image-oem-22.04Upgrade linux-image-6.8.0-1043-oracleUpgrade linux-image-virtualUpgrade linux-image-raspi-realtime-6.8Upgrade linux-image-5.15.0-163-fipsUpgrade linux-image-gkeUpgrade linux-image-nvidia-5.15Upgrade linux-image-6.8.0-100-fipsUpgrade linux-image-6.8.0-1046-aws-64kUpgrade linux-image-6.8.0-1046-nvidia-64kUpgrade linux-image-xilinx-zynqmp-5.15Upgrade linux-image-6.8.0-1030-gkeopUpgrade linux-image-xilinx-6.8Upgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-lowlatency-64k-5.15Upgrade linux-image-azure-lts-24.04Upgrade linux-image-5.15.0-163-lowlatencyUpgrade linux-image-5.15.0-163-generic-64kUpgrade linux-image-raspi-6.8Upgrade linux-image-generic-64k-6.8Upgrade linux-image-realtime-6.8.1Upgrade linux-image-6.8.0-1047-gcp-64kUpgrade linux-image-xilinxUpgrade linux-image-realtimeUpgrade linux-image-raspi-realtimeUpgrade linux-image-oem-20.04dUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-gkeop-5.15Upgrade linux-image-gke-64kUpgrade linux-image-azure-cvmUpgrade linux-image-6.8.0-2037-raspi-realtimeUpgrade linux-image-6.8.0-1046-nvidiaUpgrade linux-image-6.8.0-100-genericUpgrade linux-image-aws-fips-6.8Upgrade linux-image-6.8.0-1047-gcp-fipsUpgrade linux-image-awsUpgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-6.8.0-1046-aws-fipsUpgrade linux-image-virtual-5.15Upgrade linux-image-oem-22.04dUpgrade linux-image-aws-lts-24.04Upgrade linux-image-5.15.0-1092-nvidiaUpgrade linux-image-6.8.1-1041-realtimeUpgrade linux-image-generic-6.8Upgrade linux-image-5.15.0-1097-gcpUpgrade linux-image-6.8.0-100-lowlatencyUpgrade linux-image-5.15.0-1089-intel-iot-realtimeUpgrade linux-image-nvidia-tegra-igx-rtUpgrade linux-image-kvmUpgrade linux-image-gke-64k-6.8Upgrade linux-image-5.15.0-1097-aws-64kUpgrade linux-image-5.15.0-1101-azureUpgrade linux-image-5.15.0-163-lowlatency-64kUpgrade linux-image-raspi-nolpaeUpgrade linux-image-generic-64k-5.15Upgrade linux-image-5.15.0-1093-gkeUpgrade linux-image-gcpUpgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-ibm-classicUpgrade linux-image-generic-hwe-20.04Upgrade linux-image-gcp-lts-24.04Upgrade linux-image-gcp-6.8Upgrade linux-image-azure-5.15Upgrade linux-image-aws-64k-lts-24.04Upgrade linux-image-6.8.0-1043-gke-64kUpgrade linux-image-5.15.0-1038-nvidia-tegra-igx-rtUpgrade linux-image-oracleUpgrade linux-image-intel-iot-realtime-5.15Upgrade linux-image-fips-5.15Upgrade linux-image-aws-lts-22.04Upgrade linux-image-oracle-6.8Upgrade linux-image-nvidia-64k-6.8Upgrade linux-image-6.8.0-100-lowlatency-64kUpgrade linux-image-5.15.0-1091-ibmUpgrade linux-image-oracle-64k-lts-24.04Upgrade linux-image-virtual-hwe-20.04Upgrade linux-image-5.15.0-1092-nvidia-lowlatencyUpgrade linux-image-oracle-5.15Upgrade linux-image-azure-fipsUpgrade linux-image-6.8.0-1043-oracle-64kUpgrade linux-image-virtual-6.8Upgrade linux-image-nvidia-64kUpgrade linux-image-ibm-6.8Upgrade linux-image-gcp-fipsUpgrade linux-image-azure-fips-6.8Upgrade linux-image-6.8.0-1046-nvidia-lowlatencyUpgrade linux-image-realtime-5.15Upgrade linux-image-raspi-5.15Upgrade linux-image-ibm-lts-24.04Upgrade linux-image-aws-64k-6.8Upgrade linux-image-6.8.0-1047-raspiUpgrade linux-image-6.8.0-1046-azure-fipsUpgrade linux-image-oracle-64kUpgrade linux-image-oem-22.04bUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-generic-hwe-22.04Upgrade linux-image-fips-6.8Upgrade linux-image-aws-64k-5.15Upgrade linux-image-5.15.0-1080-gkeopUpgrade linux-image-5.15.0-1049-nvidia-tegraUpgrade linux-image-5.15.0-1094-oracleUpgrade linux-image-nvidia-tegra-igxUpgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-gcp-5.15 | Dec 5, 2025 | Sep 5, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Sep 19, 2025 | Sep 5, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub