Skip to content
CVE PROGRAM SOURCE RECORD7.8 High

CVE-2026-23278

netfilter: nf_tables: always walk all pending catchall elements

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: always walk all pending catchall elements During transaction processing we might have more than one catchall element: 1 live catchall element and 1 pending element that is coming as part of the new batch. If the map holding the catchall elements is also going away, its required to toggle all catchall elements and not just the first viable candidate. Otherwise, we get: WARNING: ./include/net/netfilter/nf_tables.h:1281 at nft_data_release+0xb7/0xe0 [nf_tables], CPU#2: nft/1404 RIP: 0010:nft_data_release+0xb7/0xe0 [nf_tables] [..] __nft_set_elem_destroy+0x106/0x380 [nf_tables] nf_tables_abort_release+0x348/0x8d0 [nf_tables] nf_tables_abort+0xcf2/0x3ac0 [nf_tables] nfnetlink_rcv_batch+0x9c9/0x20e0 [..]

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 25aa2ad37c2162be1c0bc4fe6397f7e4c13f00f8 to < ae8f3cedc5f5653a5bed45c5ed016fe156e2af55affected
  • d60be2da67d172aecf866302c91ea11533eca4d9 to < c4d4e86fda707d89eaba80e343321737375f8582affected
  • 628bd3e49cba1c066228e23d71a852c23e26da73 to < 4830fb44d12f586f3f544609e086933649a9175aaffected
  • 628bd3e49cba1c066228e23d71a852c23e26da73 to < eb0948fa13298212c5f8b30ee48efdae4389ab09affected
  • 628bd3e49cba1c066228e23d71a852c23e26da73 to < de47a88c6b807910f05703fb6605f7efdaa11417affected
  • 628bd3e49cba1c066228e23d71a852c23e26da73 to < 77c26b5056d693ffe5e9f040e946251cdb55ae55affected
  • 628bd3e49cba1c066228e23d71a852c23e26da73 to < 7cb9a23d7ae40a702577d3d8bacb7026f04ac2a9affected
  • bc9f791d2593f17e39f87c6e2b3a36549a3705b1affected
  • 3c7ec098e3b588434a8b07ea9b5b36f04cef1f50affected
  • a136b7942ad2a50de708f76ea299ccb45ac7a7f9affected
  • dc7cdf8cbcbf8b13de1df93f356ec04cdeef5c41affected
  • 5.15.121 to < 5.15.224affected
  • 6.1.36 to < 6.1.177affected
  • 4.19.316 to < 4.20affected
  • 5.4.262 to < 5.5affected
  • 5.10.188 to < 5.11affected
  • 6.3.10 to < 6.4affected

Linux Linux

Default version status: affected

  • 6.4affected
  • 0 to < 6.4unaffected
  • 5.15.224 to ≤ 5.15.*unaffected
  • 6.1.177 to ≤ 6.1.*unaffected
  • 6.6.144 to ≤ 6.6.*unaffected
  • 6.12.78 to ≤ 6.12.*unaffected
  • 6.18.19 to ≤ 6.18.*unaffected
  • 6.19.9 to ≤ 6.19.*unaffected
  • 7.0 to ≤ *unaffected

References