In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_reject: don't leak dst refcount for loopback packets
recent patches to add a WARN() when replacing skb dst entry found an old bug:
WARNING: include/linux/skbuff.h:1165 skb_dst_check_unset include/linux/skbuff.h:1164 [inline] WARNING: include/linux/skbuff.h:1165 skb_dst_set include/linux/skbuff.h:1210 [inline] WARNING: include/linux/skbuff.h:1165 nf_reject_fill_skb_dst+0x2a4/0x330 net/ipv4/netfilter/nf_reject_ipv4.c:234 [..] Call Trace: nf_send_unreach+0x17b/0x6e0 net/ipv4/netfilter/nf_reject_ipv4.c:325 nft_reject_inet_eval+0x4bc/0x690 net/netfilter/nft_reject_inet.c:27 expr_call_ops_eval net/netfilter/nf_tables_core.c:237 [inline] ..
This is because blamed commit forgot about loopback packets. Such packets already have a dst_entry attached, even at PRE_ROUTING stage.
Instead of checking hook just check if the skb already has a route attached to it.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade kernel-develUpgrade kernel-livepatch-5.10.242-239.961Upgrade perfUpgrade perf-debuginfoUpgrade kernel-tools-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-debuginfoUpgrade kernelUpgrade kernel-tools-develUpgrade kernel-headersUpgrade kernel-debuginfo-common-x86_64Upgrade python-perf-debuginfoUpgrade kernel-livepatch-5.15.191-132.213Upgrade python-perfUpgrade bpftoolUpgrade kernel-toolsUpgrade bpftool-debuginfo | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade kernel-libbpf-debuginfoUpgrade kernel-tools-debuginfoUpgrade kernel6.12-tools-develUpgrade kernel6.12-debuginfo-common-x86_64Upgrade bpftoolUpgrade kernel-livepatch-6.12.46-66.121Upgrade python3-perfUpgrade kernel-develUpgrade python3-perf-debuginfoUpgrade kernel6.12-toolsUpgrade perf6.12-debuginfoUpgrade kernel-debuginfoUpgrade kernel-libbpfUpgrade kernel-modules-extraUpgrade kernel6.12-develUpgrade kernel-tools-develUpgrade kernel6.12Upgrade perfUpgrade kernel-debuginfo-common-aarch64Upgrade python3-perf6.12Upgrade kernel6.12-headersUpgrade kernel6.12-libbpf-debuginfoUpgrade kernel6.12-modules-extra-commonUpgrade bpftool-debuginfoUpgrade python3-perf6.12-debuginfoUpgrade kernel6.12-modules-extraUpgrade bpftool6.12Upgrade kernel6.12-debuginfo-common-aarch64Upgrade kernel-modules-extra-commonUpgrade kernel6.12-debuginfoUpgrade kernel6.12-libbpfUpgrade kernel-libbpf-develUpgrade kernel-toolsUpgrade perf-debuginfoUpgrade kernel-livepatch-6.1.150-174.273Upgrade kernel-libbpf-staticUpgrade kernel-headersUpgrade perf6.12Upgrade kernel6.12-tools-debuginfoUpgrade kernel6.12-libbpf-develUpgrade bpftool6.12-debuginfoUpgrade kernelUpgrade kernel6.12-libbpf-staticUpgrade kernel-debuginfo-common-x86_64 | Sep 30, 2025 | Sep 5, 2025 |
| Debian | — | Upgrade linux-6.1Upgrade linux | Sep 25, 2025 | Sep 25, 2025 |
| Huawei Euleros 2_0_sp12 | — | Upgrade python3-perfUpgrade kernel-tools-libsUpgrade kernel-toolsUpgrade bpftoolUpgrade kernelUpgrade kernel-abi-stablelists | Mar 17, 2026 | Mar 16, 2026 |
| Huawei Euleros 2_0_sp13 | — | Upgrade python3-perfUpgrade kernel-toolsUpgrade bpftoolUpgrade kernel-tools-libsUpgrade kernelUpgrade kernel-abi-stablelists | Mar 10, 2026 | Mar 10, 2026 |
| Oracle_linux | — | Upgrade kernel-uek | Nov 11, 2025 | Sep 5, 2025 |
| Redhat_linux | — | No solution exists | Jul 17, 2026 | Sep 5, 2025 |
| Suse | — | Upgrade dtb-xilinxUpgrade kernel-default-vdsoUpgrade dtb-qcomUpgrade kernel-kvmsmallUpgrade gfs2-kmp-azureUpgrade kernel-default-base-rebuildUpgrade kernel-sourceUpgrade ocfs2-kmp-defaultUpgrade cluster-md-kmp-64kbUpgrade dlm-kmp-64kbUpgrade dtb-armUpgrade kernel-rt-develUpgrade kernel-devel-rtUpgrade kernel-rtUpgrade gfs2-kmp-rtUpgrade dtb-rockchipUpgrade kernel-64kb-develUpgrade dtb-sprdUpgrade kernel-default-optionalUpgrade ocfs2-kmp-azureUpgrade kernel-obs-buildUpgrade kernel-rt-extraUpgrade kernel-azure-optionalUpgrade dtb-mediatekUpgrade kernel-develUpgrade kernel-rt-livepatchUpgrade dtb-alteraUpgrade dtb-nvidiaUpgrade cluster-md-kmp-rtUpgrade dtb-allwinnerUpgrade kselftests-kmp-64kbUpgrade reiserfs-kmp-azureUpgrade kernel-syms-azureUpgrade kernel-devel-azureUpgrade dtb-caviumUpgrade dtb-exynosUpgrade kernel-azure-develUpgrade kernel-docsUpgrade kernel-kvmsmall-develUpgrade dlm-kmp-defaultUpgrade kernel-defaultUpgrade kselftests-kmp-defaultUpgrade kernel-default-develUpgrade gfs2-kmp-defaultUpgrade kselftests-kmp-azureUpgrade dtb-hisiliconUpgrade kernel-source-azureUpgrade kernel-rt_debug-vdsoUpgrade kernel-default-baseUpgrade kernel-64kb-extraUpgrade dlm-kmp-rtUpgrade kernel-macrosUpgrade dtb-lgUpgrade kernel-rt_debugUpgrade kernel-64kb-optionalUpgrade kernel-rt-livepatch-develUpgrade kernel-default-livepatchUpgrade kernel-default-extraUpgrade kernel-azure-vdsoUpgrade kernel-64kbUpgrade dtb-appleUpgrade dtb-amazonUpgrade kernel-source-vanillaUpgrade kernel-azure-extraUpgrade dtb-broadcomUpgrade kernel-source-rtUpgrade kernel-kvmsmall-vdsoUpgrade kernel-debug-vdsoUpgrade kernel-debug-develUpgrade cluster-md-kmp-defaultUpgrade reiserfs-kmp-defaultUpgrade kernel-obs-qaUpgrade dtb-amlogicUpgrade kernel-azureUpgrade kernel-symsUpgrade kernel-rt-vdsoUpgrade kernel-rt-optionalUpgrade kernel-docs-htmlUpgrade gfs2-kmp-64kbUpgrade dlm-kmp-azureUpgrade reiserfs-kmp-64kbUpgrade ocfs2-kmp-rtUpgrade kselftests-kmp-rtUpgrade kernel-syms-rtUpgrade dtb-freescaleUpgrade dtb-renesasUpgrade dtb-apmUpgrade reiserfs-kmp-rtUpgrade dtb-socionextUpgrade kernel-zfcpdumpUpgrade kernel-rt_debug-develUpgrade kernel-debugUpgrade dtb-marvellUpgrade ocfs2-kmp-64kbUpgrade kernel-default-livepatch-develUpgrade dtb-amdUpgrade cluster-md-kmp-azure | Dec 5, 2025 | Oct 15, 2025 |
| Ubuntu | — | Upgrade linux-image-gcp-64k-lts-24.04Upgrade linux-image-nvidia-lowlatency-5.15Upgrade linux-image-6.8.0-1047-gcpUpgrade linux-image-nvidia-tegra-5.15Upgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-5.15.0-1061-xilinx-zynqmpUpgrade linux-image-5.15.0-1096-realtimeUpgrade linux-image-oracle-lts-22.04Upgrade linux-image-nvidia-tegraUpgrade linux-image-oem-20.04bUpgrade linux-image-lowlatencyUpgrade linux-image-5.15.0-1049-nvidia-tegra-rtUpgrade linux-image-nvidia-tegra-igx-5.15Upgrade linux-image-nvidia-5.15Upgrade linux-image-generic-5.15Upgrade linux-image-virtual-hwe-22.04Upgrade linux-image-xilinx-zynqmpUpgrade linux-image-aws-fipsUpgrade linux-image-ibm-5.15Upgrade linux-image-intel-iot-realtimeUpgrade linux-image-oem-22.04cUpgrade linux-image-fipsUpgrade linux-image-oem-22.04Upgrade linux-image-nvidia-lowlatency-6.8Upgrade linux-image-aws-6.8Upgrade linux-image-nvidia-tegra-igx-rt-5.15Upgrade linux-image-oracle-64k-6.8Upgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-raspi-realtime-6.8Upgrade linux-image-generic-64kUpgrade linux-image-azure-fips-5.15Upgrade linux-image-5.15.0-1101-azure-fipsUpgrade linux-image-gkeopUpgrade linux-image-nvidiaUpgrade linux-image-azure-lts-22.04Upgrade linux-image-5.15.0-1091-raspiUpgrade linux-image-gcp-64k-6.8Upgrade linux-image-genericUpgrade linux-image-intel-iotg-5.15Upgrade linux-image-lowlatency-64k-6.8Upgrade linux-image-5.15.0-1102-azureUpgrade linux-image-5.15.0-1097-aws-fipsUpgrade linux-image-generic-lpae-5.15Upgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-nvidia-6.8Upgrade linux-image-gkeUpgrade linux-image-5.15.0-163-fipsUpgrade linux-image-oem-20.04cUpgrade linux-image-generic-lpaeUpgrade linux-image-realtime-hwe-22.04Upgrade linux-image-6.8.0-1044-ibmUpgrade linux-image-5.15.0-1092-intel-iotgUpgrade linux-image-5.15.0-1097-awsUpgrade linux-image-azureUpgrade linux-image-6.8.0-100-fipsUpgrade linux-image-6.8.0-1046-awsUpgrade linux-image-6.8.0-1046-aws-64kUpgrade linux-image-aws-5.15Upgrade linux-image-lowlatency-5.15Upgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-nvidia-tegra-rt-5.15Upgrade linux-image-oem-22.04aUpgrade linux-image-5.15.0-1038-nvidia-tegra-igxUpgrade linux-image-5.15.0-163-generic-lpaeUpgrade linux-image-6.8.0-1051-azureUpgrade linux-image-gcp-fips-5.15Upgrade linux-image-6.8.0-1046-azureUpgrade linux-image-gcp-fips-6.8Upgrade linux-image-6.8.0-100-generic-64kUpgrade linux-image-6.8.0-1023-xilinxUpgrade linux-image-6.8.0-1043-gkeUpgrade linux-image-aws-fips-5.15Upgrade linux-image-nvidia-lowlatency-64k-6.8Upgrade linux-image-nvidia-tegra-rtUpgrade linux-image-lowlatency-64kUpgrade linux-image-raspiUpgrade linux-image-ibmUpgrade linux-image-lowlatency-6.8Upgrade linux-image-5.15.0-163-genericUpgrade linux-image-aws-64k-lts-22.04Upgrade linux-image-gke-5.15Upgrade linux-image-gke-6.8Upgrade linux-image-6.8.0-1043-oracleUpgrade linux-image-intelUpgrade linux-image-gcp-64kUpgrade linux-image-oracle-lts-24.04Upgrade linux-image-5.15.0-1089-kvmUpgrade linux-image-kvm-5.15Upgrade linux-image-oem-20.04Upgrade linux-image-intel-iotgUpgrade linux-image-azure-6.8Upgrade linux-image-6.8.0-1046-nvidia-lowlatency-64kUpgrade linux-image-aws-64kUpgrade linux-image-5.15.0-1097-gcp-fipsUpgrade linux-image-virtualUpgrade linux-image-gcp-lts-22.04Upgrade linux-image-gkeop-6.8Upgrade linux-image-5.15.0-1091-ibmUpgrade linux-image-gcp-lts-24.04Upgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-generic-64k-5.15Upgrade linux-image-aws-64k-6.8Upgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-6.8.0-1047-raspiUpgrade linux-image-6.8.0-1047-gcp-fipsUpgrade linux-image-6.8.0-1046-azure-fipsUpgrade linux-image-raspi-5.15Upgrade linux-image-ibm-lts-24.04Upgrade linux-image-6.8.0-1043-oracle-64kUpgrade linux-image-6.8.0-1046-nvidia-lowlatencyUpgrade linux-image-virtual-6.8Upgrade linux-image-nvidia-64kUpgrade linux-image-azure-fips-6.8Upgrade linux-image-azure-fipsUpgrade linux-image-ibm-6.8Upgrade linux-image-gcp-fipsUpgrade linux-image-realtime-5.15Upgrade linux-image-6.8.0-2037-raspi-realtimeUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-gkeop-5.15Upgrade linux-image-aws-fips-6.8Upgrade linux-image-gke-64kUpgrade linux-image-azure-cvmUpgrade linux-image-6.8.0-1046-nvidiaUpgrade linux-image-6.8.0-100-genericUpgrade linux-image-realtimeUpgrade linux-image-raspi-realtimeUpgrade linux-image-oem-20.04dUpgrade linux-image-generic-64k-6.8Upgrade linux-image-raspi-6.8Upgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-aws-lts-22.04Upgrade linux-image-gcp-5.15Upgrade linux-image-azure-lts-24.04Upgrade linux-image-6.8.0-1046-nvidia-64kUpgrade linux-image-6.8.0-1046-aws-fipsUpgrade linux-image-realtime-6.8.1Upgrade linux-image-6.8.0-1030-gkeopUpgrade linux-image-5.15.0-163-lowlatencyUpgrade linux-image-5.15.0-163-generic-64kUpgrade linux-image-xilinx-zynqmp-5.15Upgrade linux-image-nvidia-tegra-igxUpgrade linux-image-aws-64k-lts-24.04Upgrade linux-image-5.15.0-1038-nvidia-tegra-igx-rtUpgrade linux-image-azure-5.15Upgrade linux-image-fips-6.8Upgrade linux-image-aws-64k-5.15Upgrade linux-image-nvidia-lowlatencyUpgrade linux-image-generic-hwe-22.04Upgrade linux-image-6.8.0-1047-gcp-64kUpgrade linux-image-5.15.0-1094-oracleUpgrade linux-image-5.15.0-1080-gkeopUpgrade linux-image-5.15.0-1049-nvidia-tegraUpgrade linux-image-xilinxUpgrade linux-image-oracle-64kUpgrade linux-image-gcpUpgrade linux-image-awsUpgrade linux-image-gcp-6.8Upgrade linux-image-xilinx-6.8Upgrade linux-image-oem-22.04bUpgrade linux-image-5.15.0-1092-nvidia-lowlatencyUpgrade linux-image-fips-5.15Upgrade linux-image-ibm-classicUpgrade linux-image-generic-hwe-20.04Upgrade linux-image-6.8.0-1043-gke-64kUpgrade linux-image-oracleUpgrade linux-image-lowlatency-64k-5.15Upgrade linux-image-intel-iot-realtime-5.15Upgrade linux-image-5.15.0-1092-nvidiaUpgrade linux-image-nvidia-64k-6.8Upgrade linux-image-aws-lts-24.04Upgrade linux-image-6.8.1-1041-realtimeUpgrade linux-image-6.8.0-100-lowlatency-64kUpgrade linux-image-virtual-hwe-20.04Upgrade linux-image-virtual-5.15Upgrade linux-image-oracle-64k-lts-24.04Upgrade linux-image-oracle-6.8Upgrade linux-image-oracle-5.15Upgrade linux-image-oem-22.04dUpgrade linux-image-kvmUpgrade linux-image-gke-64k-6.8Upgrade linux-image-generic-6.8Upgrade linux-image-6.8.0-100-lowlatencyUpgrade linux-image-5.15.0-163-lowlatency-64kUpgrade linux-image-5.15.0-1093-gkeUpgrade linux-image-5.15.0-1097-aws-64kUpgrade linux-image-5.15.0-1097-gcpUpgrade linux-image-5.15.0-1089-intel-iot-realtimeUpgrade linux-image-nvidia-tegra-igx-rtUpgrade linux-image-5.15.0-1101-azureUpgrade linux-image-raspi-nolpae | Dec 5, 2025 | Sep 5, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Sep 19, 2025 | Sep 5, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub