netfilter: ipset: drop logically empty buckets in mtype_del (Linux Linux)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.12 % · percentile 2 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- Linux
- NVD status
- Modified
Description
In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: drop logically empty buckets in mtype_del mtype_del() counts empty slots below n->pos in k, but it only drops the bucket when both n->pos and k are zero. This misses buckets whose live entries have all been removed while n->pos still points past deleted slots. Treat a bucket as empty when all positions below n->pos are unused and release it directly instead of shrinking it further.
References
- https://git.kernel.org/stable/c/c098ff857e7ca923539164af5b3c2fe3e8f8afaf
- https://git.kernel.org/stable/c/58f3a14826d4e6b0d5421f1a64be280b48601ea2
- https://git.kernel.org/stable/c/ad92ee87462f9a3061361d392e9dbfe2e5c1c9fb
- https://git.kernel.org/stable/c/6cea34d7ec6829b62f521a37a287f670144a2233
- https://git.kernel.org/stable/c/b7eef00f08b92b0b9efe8ae0df6d0005e6199323
- https://git.kernel.org/stable/c/68ca0eea0af02bed36c5e2c13e9fa1647c31a7d4
- https://git.kernel.org/stable/c/ceacaa76f221a6577aba945bb8873c2e640aeba4
- https://git.kernel.org/stable/c/9862ef9ab0a116c6dca98842aab7de13a252ae02
- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
- https://cert-portal.siemens.com/productcert/html/ssa-019113.html
- https://cert-portal.siemens.com/productcert/html/ssa-457936.html
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2026-21941
- GCVE · GCVE-0-2026-31418
CERT-FR advisories
- CERTFR-2026-AVI-1298 — Multiples vulnérabilités dans les produits Siemens · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1255 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1202 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1164 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0954 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0926 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0898 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0880 — Multiples vulnérabilités dans les produits Siemens · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0861 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0831 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0696 — Multiples vulnérabilités dans le noyau Linux de Debian LTS · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0548 — Multiples vulnérabilités dans le noyau Linux de Debian · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0547 — Multiples vulnérabilités dans le noyau Linux de Debian LTS · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0463 — Multiples vulnérabilités dans les produits Microsoft · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.4.24 < 5.5cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.5.8 < 5.6cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.6.1 < 5.10.253cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.11 < 5.15.203cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.16 < 6.1.168cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.2 < 6.6.134cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.7 < 6.12.81cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.13 < 6.18.22cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.19 < 6.19.12cpe:2.3:o:linux:linux_kernel:5.6:-:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:5.6:rc4:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:5.6:rc5:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:5.6:rc6:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:5.6:rc7:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| Linux · Linux | affected 8af1c6fbd9239877998c7f5a591cb2c88d41fb66 < c098ff857e7ca923539164af5b3c2fe3e8f8afaf ; affected 8af1c6fbd9239877998c7f5a591cb2c88d41fb66 < 58f3a14826d4e6b0d5421f1a64be280b48601ea2 ; affected 8af1c6fbd9239877998c7f5a591cb2c88d41fb66 < ad92ee87462f9a3061361d392e9dbfe2e5c1c9fb ; affected 8af1c6fbd9239877998c7f5a591cb2c88d41fb66 < 6cea34d7ec6829b62f521a37a287f670144a2233 ; affected 8af1c6fbd9239877998c7f5a591cb2c88d41fb66 < b7eef00f08b92b0b9efe8ae0df6d0005e6199323 ; affected 8af1c6fbd9239877998c7f5a591cb2c88d41fb66 < 68ca0eea0af02bed36c5e2c13e9fa1647c31a7d4 |
| Linux · Linux | affected 5.6 ; unaffected 0 < 5.6 ; unaffected 5.10.253 ≤ 5.10.* ; unaffected 5.15.203 ≤ 5.15.* ; unaffected 6.1.168 ≤ 6.1.* ; unaffected 6.6.134 ≤ 6.6.* |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |