In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref()
Incoming skbs passing through netfilter flowtable offload hooks (or XFRM offload path) might already carry a ref-counted dst_entry assigned during earlier RX or routing steps.
Calling skb_dst_set_noref() when skb already holds a ref-counted dst overwrites skb->_skb_refdst, leaking the previous dst_entry reference count and triggering a DEBUG_NET_WARN_ON_ONCE assertion in skb_dst_check_unset():
WARNING: at skb_dst_check_unset include/linux/skbuff.h:1170 WARNING: at skb_dst_set_noref include/linux/skbuff.h:1234 WARNING: at nf_flow_offload_ip_hook+0xf6c/0x2b60 net/netfilter/nf_flow_table_ip.c:864
Drop any existing dst_entry reference with skb_dst_drop(skb) before setting the non-referenced flowtable destination.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade python3-perf6.18Upgrade perf6.18Upgrade kernel6.18-headersUpgrade microvm-kernel6.18Upgrade kernel6.18-toolsUpgrade kernel6.18-debuginfo-common-x86_64Upgrade kernel6.18-develUpgrade kernel6.18-debuginfoUpgrade kernel6.18-tools-develUpgrade kernel6.18-modules-extraUpgrade bpftool6.18-debuginfoUpgrade kernel6.18-tools-debuginfoUpgrade bpftool6.18Upgrade kernel6.18Upgrade kernel6.18-modules-extra-commonUpgrade python3-perf6.18-debuginfoUpgrade kernel6.18-debuginfo-common-aarch64Upgrade kernel-livepatch-6.18.48-107.148Upgrade perf6.18-debuginfo | Sep 30, 2026 | Aug 22, 2026 |
| Redhat_linux | — | No solution exists | Aug 25, 2026 | Aug 22, 2026 |
| Ubuntu | — | Upgrade linux-image-nvidia-tegraUpgrade linux-image-6.8.0-1036-nvidia-tegraUpgrade linux-image-nvidia-tegra-6.8Upgrade linux-image-nvidia-tegra-rt-6.8Upgrade linux-image-nvidia-tegra-rtUpgrade linux-image-6.8.0-1036-nvidia-tegra-rt | Oct 7, 2026 | Oct 6, 2026 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub