Description
In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path nfqnl_recv_verdict() calls find_dequeue_entry() to remove the queue entry from the queue data structures, taking ownership of the entry. For PF_BRIDGE packets, it then calls nfqa_parse_bridge() to parse VLAN attributes. If nfqa_parse_bridge() returns an error (e.g. NFQA_VLAN present but NFQA_VLAN_TCI missing), the function returns immediately without freeing the dequeued entry or its sk_buff. This leaks the nf_queue_entry, its associated sk_buff, and all held references (net_device refcounts, struct net refcount). Repeated triggering exhausts kernel memory. Fix this by dropping the entry via nfqnl_reinject() with NF_DROP verdict on the error path, consistent with other error handling in this file.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
8d45ff22f1b43249f0cf1baafe0262ca10d1666e to < a907bea273b60d3e604ec4e8e1f6c49954805794affected8d45ff22f1b43249f0cf1baafe0262ca10d1666e to < 0b18d1b834ab5a5009be70b530f978d7989e445baffected8d45ff22f1b43249f0cf1baafe0262ca10d1666e to < b38d2b4603fd3dda24eb8b3dd81c18a0930be97baffected8d45ff22f1b43249f0cf1baafe0262ca10d1666e to < 47b1c5d1b0944aa88299f55a846fabaefc756982affected8d45ff22f1b43249f0cf1baafe0262ca10d1666e to < cf4a4df38d1747e06fc54f9879bd7a6f4178032faffected8d45ff22f1b43249f0cf1baafe0262ca10d1666e to < 9853d94b82d303fc4ac37d592a23a154096ecd41affected8d45ff22f1b43249f0cf1baafe0262ca10d1666e to < 208669df703a25a601f45822b10c413f258bf275affected8d45ff22f1b43249f0cf1baafe0262ca10d1666e to < f1ba83755d81c6fc66ac7acd723d238f974091e9affected
Linux Linux
Default version status: affected
4.7affected0 to < 4.7unaffected5.10.253 to ≤ 5.10.*unaffected5.15.203 to ≤ 5.15.*unaffected6.1.167 to ≤ 6.1.*unaffected6.6.130 to ≤ 6.6.*unaffected6.12.78 to ≤ 6.12.*unaffected6.18.19 to ≤ 6.18.*unaffected6.19.9 to ≤ 6.19.*unaffected7.0 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/a907bea273b60d3e604ec4e8e1f6c49954805794 ↗
- https://git.kernel.org/stable/c/0b18d1b834ab5a5009be70b530f978d7989e445b ↗
- https://git.kernel.org/stable/c/b38d2b4603fd3dda24eb8b3dd81c18a0930be97b ↗
- https://git.kernel.org/stable/c/47b1c5d1b0944aa88299f55a846fabaefc756982 ↗
- https://git.kernel.org/stable/c/cf4a4df38d1747e06fc54f9879bd7a6f4178032f ↗
- https://git.kernel.org/stable/c/9853d94b82d303fc4ac37d592a23a154096ecd41 ↗
- https://git.kernel.org/stable/c/208669df703a25a601f45822b10c413f258bf275 ↗
- https://git.kernel.org/stable/c/f1ba83755d81c6fc66ac7acd723d238f974091e9 ↗