netfilter: flowtable: publish GC-visible tuple last (Linux Linux)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.54 % · percentile 45 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- Linux
- NVD status
- Received
Description
In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: publish GC-visible tuple last nf_flow_table_iterate() only treats original-direction tuple nodes as owning entries. Publishing the original node first lets GC observe and free a flow while flow_offload_add() is still inserting the reply node. Publish the reply node first and the original node last so GC never sees a partially installed flow. KASAN can trigger slab-use-after-free read and write reports in the flowtable/rhashtable path (rht_deferred_worker, jhash, flow_offload_del, flow_offload_lookup, etc.).
References
- https://git.kernel.org/stable/c/0a00254585827f1695aa2700114af622ea754cfa
- https://git.kernel.org/stable/c/be345dcbddb4643a54252b954af974b16eda8f91
- https://git.kernel.org/stable/c/211ee5d998d92a7d548811939c65942d06c146e4
- https://git.kernel.org/stable/c/d37917e7bebe078f3c17e47fd6fc1c9f6e8497b2
- https://git.kernel.org/stable/c/972fdf7c4f5c282a239c88fea614b056c33dc025
- https://git.kernel.org/stable/c/d9d3050a70efe217e73a0751e55fdae6a7092620
- https://git.kernel.org/stable/c/d16b71231e65cb05daea2b45701fcf09cef041e7
- https://git.kernel.org/stable/c/2014ac62df9d45bb9a004a043e85df7be09ed780
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | CRITICAL 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | Linux |
| CVSS 3.1 | CRITICAL 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | NVD · 416baaa9-dc9f-4396-8d5f-8c081fb06d67 (Secondary) |
European references
- ENISA EUVD · EUVD-2026-66576
- GCVE · GCVE-0-2026-74746
CERT-FR advisories
- CERTFR-2026-AVI-1287 — Multiples vulnérabilités dans le noyau Linux de Red Hat · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1286 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1254 — Multiples vulnérabilités dans le noyau Linux de Red Hat · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1232 — Multiples vulnérabilités dans le noyau Linux de Debian LTS · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1163 — Multiples vulnérabilités dans le noyau Linux de Debian LTS · cert.ssi.gouv.fr
Affected products
| Product | Versions |
|---|---|
| Linux · Linux | affected ac2a66665e231847cab11b8c8e844ce43207dd2e < 0a00254585827f1695aa2700114af622ea754cfa ; affected ac2a66665e231847cab11b8c8e844ce43207dd2e < be345dcbddb4643a54252b954af974b16eda8f91 ; affected ac2a66665e231847cab11b8c8e844ce43207dd2e < 211ee5d998d92a7d548811939c65942d06c146e4 ; affected ac2a66665e231847cab11b8c8e844ce43207dd2e < d37917e7bebe078f3c17e47fd6fc1c9f6e8497b2 ; affected ac2a66665e231847cab11b8c8e844ce43207dd2e < 972fdf7c4f5c282a239c88fea614b056c33dc025 ; affected ac2a66665e231847cab11b8c8e844ce43207dd2e < d9d3050a70efe217e73a0751e55fdae6a7092620 |
| Linux · Linux | affected 4.16 ; unaffected 0 < 4.16 ; unaffected 5.10.266 ≤ 5.10.* ; unaffected 5.15.217 ≤ 5.15.* ; unaffected 6.1.184 ≤ 6.1.* ; unaffected 6.6.153 ≤ 6.6.* |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |