netfilter: nft_set_rbtree: skip sync GC for new elements in this transaction (Linux Linux)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.26 % · percentile 18 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- Linux
- NVD status
- Modified
Description
In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_rbtree: skip sync GC for new elements in this transaction New elements in this transaction might expired before such transaction ends. Skip sync GC for such elements otherwise commit path might walk over an already released object. Once transaction is finished, async GC will collect such expired element.
Weaknesses (CWE)
- CWE-273 — Improper Check for Dropped Privileges
References
- https://git.kernel.org/stable/c/9db9feb841f7449772f9393c16b9ef4536d8c127
- https://git.kernel.org/stable/c/03caf75da1059f0460666c826e9f50e13dfd0017
- https://git.kernel.org/stable/c/c323ed65f66e5387ee0a73452118d49f1dae81b8
- https://git.kernel.org/stable/c/9af7dfb3c9d7985172a240f85e684c5cd33e29ce
- https://git.kernel.org/stable/c/9a8c544158f68f656d1734eb5ba00c4f817b76b1
- https://git.kernel.org/stable/c/e3213ff99a355cda811b41e8dbb3472d13167a3a
- https://git.kernel.org/stable/c/2ee52ae94baabf7ee09cf2a8d854b990dac5d0e4
- https://security.netapp.com/advisory/ntap-20240828-0003/
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | Linux |
| CVSS 3.1 | MEDIUM 4.4 | CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H | CISA-ADP |
| CVSS 3.1 | HIGH 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | NVD · 416baaa9-dc9f-4396-8d5f-8c081fb06d67 (Secondary) |
| CVSS 3.1 | MEDIUM 4.4 | CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H | NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary) |
European references
- ENISA EUVD · EUVD-2023-57058
- GCVE · GCVE-0-2023-52433
CERT-FR advisories
- CERTFR-2026-AVI-0398 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0225 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0195 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0170 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0677 — Multiples vulnérabilités dans les produits Siemens · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0526 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0496 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:netapp:ontap_tools:9:*:*:*:*:vmware_vsphere:*:*cpe:2.3:a:netapp:ontap_tools:10:*:*:*:*:vmware_vsphere:*:*cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.5 < 6.5.4
Affected products
| Product | Versions |
|---|---|
| Linux · Linux | affected cb4d00b563675ba8ff6ef94b077f58d816f68ba3 < 9db9feb841f7449772f9393c16b9ef4536d8c127 ; affected c357648929c8dff891502349769aafb8f0452bc2 < 03caf75da1059f0460666c826e9f50e13dfd0017 ; affected 146c76866795553dbc19998f36718d7986ad302b < c323ed65f66e5387ee0a73452118d49f1dae81b8 ; affected 479a2cf5259347d6a1f658b0f791d27a34908e91 < 9af7dfb3c9d7985172a240f85e684c5cd33e29ce ; affected df650d6a4bf47248261b61ef6b174d7c54034d15 < 9a8c544158f68f656d1734eb5ba00c4f817b76b1 ; affected f6c383b8c31a93752a52697f8430a71dcbc46adf < e3213ff99a355cda811b41e8dbb3472d13167a3a |
| Linux · Linux | affected 6.5 ; unaffected 0 < 6.5 ; unaffected 6.5.4 ≤ 6.5.* ; unaffected 6.6 ≤ * |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |