In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_reject: don't leak dst refcount for loopback packets
recent patches to add a WARN() when replacing skb dst entry found an old bug:
WARNING: include/linux/skbuff.h:1165 skb_dst_check_unset include/linux/skbuff.h:1164 [inline] WARNING: include/linux/skbuff.h:1165 skb_dst_set include/linux/skbuff.h:1210 [inline] WARNING: include/linux/skbuff.h:1165 nf_reject_fill_skb_dst+0x2a4/0x330 net/ipv4/netfilter/nf_reject_ipv4.c:234 [..] Call Trace: nf_send_unreach+0x17b/0x6e0 net/ipv4/netfilter/nf_reject_ipv4.c:325 nft_reject_inet_eval+0x4bc/0x690 net/netfilter/nft_reject_inet.c:27 expr_call_ops_eval net/netfilter/nf_tables_core.c:237 [inline] ..
This is because blamed commit forgot about loopback packets. Such packets already have a dst_entry attached, even at PRE_ROUTING stage.
Instead of checking hook just check if the skb already has a route attached to it.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade bpftoolUpgrade python-perfUpgrade kernel-toolsUpgrade bpftool-debuginfoUpgrade kernel-livepatch-5.15.191-132.213Upgrade kernel-debuginfo-common-x86_64Upgrade kernel-headersUpgrade python-perf-debuginfoUpgrade kernel-tools-develUpgrade kernel-livepatch-5.10.242-239.961Upgrade kernel-debuginfo-common-aarch64Upgrade kernel-tools-debuginfoUpgrade perf-debuginfoUpgrade kernel-debuginfoUpgrade kernelUpgrade perfUpgrade kernel-devel | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade kernel-libbpf-staticUpgrade kernel-headersUpgrade kernelUpgrade kernel6.12-tools-debuginfoUpgrade kernel6.12-debuginfo-common-aarch64Upgrade kernel-modules-extra-commonUpgrade kernel6.12-debuginfoUpgrade kernel-livepatch-6.1.150-174.273Upgrade kernel6.12-libbpfUpgrade kernel-toolsUpgrade python3-perf6.12-debuginfoUpgrade perf-debuginfoUpgrade kernel6.12-modules-extra-commonUpgrade bpftool6.12Upgrade bpftool-debuginfoUpgrade bpftool6.12-debuginfoUpgrade kernel-libbpf-develUpgrade kernel6.12-libbpf-staticUpgrade perf6.12Upgrade kernel6.12-libbpf-develUpgrade kernel6.12-modules-extraUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-modules-extraUpgrade kernel-debuginfoUpgrade perf6.12-debuginfoUpgrade kernel6.12-develUpgrade kernel6.12-tools-develUpgrade kernel6.12-debuginfo-common-x86_64Upgrade python3-perfUpgrade bpftoolUpgrade kernel-livepatch-6.12.46-66.121Upgrade kernel-develUpgrade python3-perf6.12Upgrade kernel6.12-libbpf-debuginfoUpgrade kernel-libbpfUpgrade kernel6.12-headersUpgrade kernel6.12Upgrade python3-perf-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-tools-debuginfoUpgrade kernel-libbpf-debuginfoUpgrade perfUpgrade kernel6.12-toolsUpgrade kernel-tools-devel | Sep 30, 2025 | Sep 5, 2025 |
| Debian | — | Upgrade linux-6.1Upgrade linux | Sep 25, 2025 | Sep 25, 2025 |
| Huawei Euleros 2_0_sp12 | — | Upgrade kernelUpgrade kernel-abi-stablelistsUpgrade kernel-tools-libsUpgrade bpftoolUpgrade python3-perfUpgrade kernel-tools | Mar 17, 2026 | Mar 16, 2026 |
| Huawei Euleros 2_0_sp13 | — | Upgrade kernel-toolsUpgrade kernel-tools-libsUpgrade python3-perfUpgrade bpftoolUpgrade kernel-abi-stablelistsUpgrade kernel | Mar 10, 2026 | Mar 10, 2026 |
| Oracle_linux | — | Upgrade kernel-uek | Nov 11, 2025 | Sep 5, 2025 |
| Redhat_linux | — | No solution exists | Jul 17, 2026 | Sep 5, 2025 |
| Suse | — | Upgrade dtb-sprdUpgrade dtb-rockchipUpgrade kernel-default-optionalUpgrade kernel-rt-develUpgrade kselftests-kmp-64kbUpgrade kernel-syms-azureUpgrade kernel-azure-optionalUpgrade dtb-armUpgrade reiserfs-kmp-azureUpgrade kernel-develUpgrade gfs2-kmp-azureUpgrade kernel-kvmsmallUpgrade kernel-default-vdsoUpgrade dtb-xilinxUpgrade kernel-rt-livepatchUpgrade kernel-rtUpgrade kernel-azure-develUpgrade ocfs2-kmp-azureUpgrade dtb-exynosUpgrade cluster-md-kmp-rtUpgrade kernel-devel-azureUpgrade kernel-devel-rtUpgrade dtb-caviumUpgrade dtb-allwinnerUpgrade gfs2-kmp-rtUpgrade kernel-64kb-develUpgrade kernel-default-base-rebuildUpgrade dtb-qcomUpgrade dtb-alteraUpgrade dtb-mediatekUpgrade dtb-nvidiaUpgrade kernel-rt-extraUpgrade dlm-kmp-64kbUpgrade kernel-sourceUpgrade cluster-md-kmp-64kbUpgrade ocfs2-kmp-defaultUpgrade kernel-obs-buildUpgrade kernel-defaultUpgrade kernel-debug-vdsoUpgrade kernel-azure-vdsoUpgrade reiserfs-kmp-defaultUpgrade kernel-kvmsmall-vdsoUpgrade dtb-appleUpgrade dtb-amazonUpgrade dlm-kmp-defaultUpgrade kernel-zfcpdumpUpgrade kernel-rt_debug-develUpgrade kernel-debugUpgrade dtb-marvellUpgrade dtb-freescaleUpgrade gfs2-kmp-defaultUpgrade dtb-socionextUpgrade dtb-renesasUpgrade ocfs2-kmp-rtUpgrade kernel-syms-rtUpgrade kernel-symsUpgrade kernel-rt-vdsoUpgrade kernel-rt-optionalUpgrade kernel-docs-htmlUpgrade kernel-docsUpgrade kernel-azureUpgrade gfs2-kmp-64kbUpgrade dlm-kmp-azureUpgrade reiserfs-kmp-64kbUpgrade reiserfs-kmp-rtUpgrade ocfs2-kmp-64kbUpgrade kernel-default-livepatch-develUpgrade dtb-amdUpgrade cluster-md-kmp-azureUpgrade kernel-default-develUpgrade kselftests-kmp-rtUpgrade kselftests-kmp-defaultUpgrade dtb-apmUpgrade kernel-64kbUpgrade kernel-macrosUpgrade kernel-default-livepatchUpgrade kernel-64kb-optionalUpgrade kernel-default-extraUpgrade dtb-lgUpgrade kernel-rt_debugUpgrade kernel-rt-livepatch-develUpgrade kernel-kvmsmall-develUpgrade kernel-64kb-extraUpgrade kernel-source-azureUpgrade kernel-obs-qaUpgrade kernel-default-baseUpgrade dtb-hisiliconUpgrade dtb-amlogicUpgrade dlm-kmp-rtUpgrade kselftests-kmp-azureUpgrade kernel-rt_debug-vdsoUpgrade kernel-source-vanillaUpgrade kernel-source-rtUpgrade kernel-debug-develUpgrade kernel-azure-extraUpgrade dtb-broadcomUpgrade cluster-md-kmp-default | Dec 5, 2025 | Oct 15, 2025 |
| Ubuntu | — | Upgrade linux-image-oracle-6.8Upgrade linux-image-6.8.1-1041-realtimeUpgrade linux-image-nvidia-64k-6.8Upgrade linux-image-5.15.0-1092-nvidia-lowlatencyUpgrade linux-image-virtual-5.15Upgrade linux-image-generic-64k-5.15Upgrade linux-image-kvmUpgrade linux-image-5.15.0-1101-azureUpgrade linux-image-virtual-hwe-20.04Upgrade linux-image-5.15.0-163-lowlatency-64kUpgrade linux-image-6.8.0-100-lowlatencyUpgrade linux-image-5.15.0-1097-gcpUpgrade linux-image-generic-6.8Upgrade linux-image-gke-64k-6.8Upgrade linux-image-oracle-5.15Upgrade linux-image-oracle-64k-lts-24.04Upgrade linux-image-generic-64k-6.8Upgrade linux-image-raspi-nolpaeUpgrade linux-image-gke-64kUpgrade linux-image-nvidia-tegra-igx-rtUpgrade linux-image-realtimeUpgrade linux-image-6.8.0-100-genericUpgrade linux-image-6.8.0-1046-nvidiaUpgrade linux-image-5.15.0-1093-gkeUpgrade linux-image-azure-cvmUpgrade linux-image-gkeop-5.15Upgrade linux-image-aws-fips-6.8Upgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-raspi-realtimeUpgrade linux-image-6.8.0-2037-raspi-realtimeUpgrade linux-image-oem-20.04dUpgrade linux-image-5.15.0-1089-intel-iot-realtimeUpgrade linux-image-5.15.0-1097-aws-64kUpgrade linux-image-oem-22.04dUpgrade linux-image-aws-lts-24.04Upgrade linux-image-5.15.0-1092-nvidiaUpgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-6.8.0-1043-oracle-64kUpgrade linux-image-6.8.0-1046-nvidia-lowlatencyUpgrade linux-image-raspi-5.15Upgrade linux-image-virtual-6.8Upgrade linux-image-6.8.0-1046-azure-fipsUpgrade linux-image-gcp-fipsUpgrade linux-image-gcp-5.15Upgrade linux-image-raspi-6.8Upgrade linux-image-xilinx-zynqmp-5.15Upgrade linux-image-6.8.0-1047-raspiUpgrade linux-image-azure-lts-24.04Upgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-nvidia-tegra-igxUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-5.15.0-163-generic-64kUpgrade linux-image-5.15.0-163-lowlatencyUpgrade linux-image-6.8.0-1030-gkeopUpgrade linux-image-6.8.0-1046-nvidia-64kUpgrade linux-image-azure-5.15Upgrade linux-image-gcp-lts-24.04Upgrade linux-image-aws-lts-22.04Upgrade linux-image-azure-fips-6.8Upgrade linux-image-gcpUpgrade linux-image-gcp-6.8Upgrade linux-image-fips-5.15Upgrade linux-image-aws-64k-lts-24.04Upgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-oracleUpgrade linux-image-6.8.0-1043-gke-64kUpgrade linux-image-xilinx-6.8Upgrade linux-image-ibm-classicUpgrade linux-image-intel-iot-realtime-5.15Upgrade linux-image-generic-hwe-20.04Upgrade linux-image-lowlatency-64k-5.15Upgrade linux-image-6.8.0-1046-aws-fipsUpgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-5.15.0-1038-nvidia-tegra-igx-rtUpgrade linux-image-6.8.0-1047-gcp-fipsUpgrade linux-image-aws-64k-5.15Upgrade linux-image-fips-6.8Upgrade linux-image-6.8.0-1047-gcp-64kUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-5.15.0-1094-oracleUpgrade linux-image-xilinxUpgrade linux-image-awsUpgrade linux-image-oem-22.04bUpgrade linux-image-5.15.0-1091-ibmUpgrade linux-image-oracle-64kUpgrade linux-image-6.8.0-100-lowlatency-64kUpgrade linux-image-5.15.0-1080-gkeopUpgrade linux-image-5.15.0-1049-nvidia-tegraUpgrade linux-image-generic-hwe-22.04Upgrade linux-image-realtime-6.8.1Upgrade linux-image-azure-fipsUpgrade linux-image-ibm-6.8Upgrade linux-image-nvidia-64kUpgrade linux-image-realtime-5.15Upgrade linux-image-aws-64k-6.8Upgrade linux-image-ibmUpgrade linux-image-nvidia-tegra-rtUpgrade linux-image-lowlatency-6.8Upgrade linux-image-gcp-fips-6.8Upgrade linux-image-gcp-fips-5.15Upgrade linux-image-aws-fips-5.15Upgrade linux-image-nvidia-tegra-igx-5.15Upgrade linux-image-nvidia-lowlatency-64k-6.8Upgrade linux-image-lowlatency-64kUpgrade linux-image-aws-64k-lts-22.04Upgrade linux-image-lowlatencyUpgrade linux-image-gkeop-6.8Upgrade linux-image-gcp-lts-22.04Upgrade linux-image-6.8.0-1046-awsUpgrade linux-image-5.15.0-1038-nvidia-tegra-igxUpgrade linux-image-5.15.0-1092-intel-iotgUpgrade linux-image-aws-5.15Upgrade linux-image-azureUpgrade linux-image-6.8.0-1046-aws-64kUpgrade linux-image-6.8.0-100-fipsUpgrade linux-image-5.15.0-1097-awsUpgrade linux-image-oem-22.04aUpgrade linux-image-nvidia-tegra-rt-5.15Upgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-gkeUpgrade linux-image-gke-6.8Upgrade linux-image-6.8.0-1043-oracleUpgrade linux-image-5.15.0-163-generic-lpaeUpgrade linux-image-5.15.0-1089-kvmUpgrade linux-image-virtualUpgrade linux-image-oracle-64k-6.8Upgrade linux-image-genericUpgrade linux-image-ibm-5.15Upgrade linux-image-generic-lpaeUpgrade linux-image-fipsUpgrade linux-image-oracle-lts-24.04Upgrade linux-image-kvm-5.15Upgrade linux-image-6.8.0-1046-nvidia-lowlatency-64kUpgrade linux-image-gcp-64kUpgrade linux-image-gke-5.15Upgrade linux-image-5.15.0-1097-gcp-fipsUpgrade linux-image-xilinx-zynqmpUpgrade linux-image-oem-22.04cUpgrade linux-image-virtual-hwe-22.04Upgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-intel-iot-realtimeUpgrade linux-image-generic-64kUpgrade linux-image-aws-fipsUpgrade linux-image-aws-6.8Upgrade linux-image-generic-5.15Upgrade linux-image-nvidia-6.8Upgrade linux-image-nvidia-5.15Upgrade linux-image-oem-22.04Upgrade linux-image-nvidia-tegra-igx-rt-5.15Upgrade linux-image-nvidia-lowlatency-6.8Upgrade linux-image-5.15.0-163-fipsUpgrade linux-image-intelUpgrade linux-image-azure-fips-5.15Upgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-raspi-realtime-6.8Upgrade linux-image-nvidiaUpgrade linux-image-intel-iotgUpgrade linux-image-generic-lpae-5.15Upgrade linux-image-azure-6.8Upgrade linux-image-5.15.0-1101-azure-fipsUpgrade linux-image-oem-20.04cUpgrade linux-image-oem-20.04Upgrade linux-image-lowlatency-5.15Upgrade linux-image-lowlatency-64k-6.8Upgrade linux-image-intel-iotg-5.15Upgrade linux-image-gkeopUpgrade linux-image-gcp-64k-6.8Upgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-azure-lts-22.04Upgrade linux-image-aws-64kUpgrade linux-image-6.8.0-1044-ibmUpgrade linux-image-5.15.0-1102-azureUpgrade linux-image-5.15.0-1097-aws-fipsUpgrade linux-image-5.15.0-1091-raspiUpgrade linux-image-nvidia-tegraUpgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-oem-20.04bUpgrade linux-image-realtime-hwe-22.04Upgrade linux-image-nvidia-tegra-5.15Upgrade linux-image-oracle-lts-22.04Upgrade linux-image-nvidia-lowlatency-5.15Upgrade linux-image-gcp-64k-lts-24.04Upgrade linux-image-6.8.0-1047-gcpUpgrade linux-image-5.15.0-1096-realtimeUpgrade linux-image-5.15.0-1061-xilinx-zynqmpUpgrade linux-image-6.8.0-1051-azureUpgrade linux-image-6.8.0-1046-azureUpgrade linux-image-6.8.0-1043-gkeUpgrade linux-image-6.8.0-1023-xilinxUpgrade linux-image-6.8.0-100-generic-64kUpgrade linux-image-5.15.0-163-genericUpgrade linux-image-raspiUpgrade linux-image-5.15.0-1049-nvidia-tegra-rt | Dec 5, 2025 | Sep 5, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Sep 19, 2025 | Sep 5, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub