Описание
In the Linux kernel, the following vulnerability has been resolved:
netfilter: flowtable: hold reference on ct until flow is released
nf_ct_put() releases the ct->ext area inmediately, the rcu typesafe
semantics also allow to refer to the wrong conntrack from the flowtable
datapath. Hold reference on ct until flow is released after rcu grace
period.
Add rcu_barrier() on module exit path, to ensure pending flow entries
are release before module goes away.
A flaw was found in the Linux kernel's netfilter subsystem. In the flowtable component, connection tracking reference counts are prematurely released before flow entries are fully removed from memory. An attacker could exploit this timing issue during network flow processing, triggering a use-after-free condition. This issue primarily leads to a Denial of Service (DoS) via a system crash or unexpected system instability.
Отчет
An Important severity use-after-free flaw was found in the Linux kernel's netfilter flowtable, affecting the kernel, kernel-rt, and kpatch packages in Red Hat Enterprise Linux 8, 9, and 10, Red Hat In-Vehicle OS, and OpenShift Container Platform through its RHEL CoreOS components. The flowtable datapath released its connection tracking reference prematurely: nf_ct_put() frees the ct extension area immediately, and the RCU typesafe semantics could allow the datapath to refer to the wrong or already-freed conntrack entry while a flow entry was still being released after the RCU grace period. An attacker able to trigger this timing window during network flow processing could cause a use-after-free condition that primarily results in a denial of service via a system crash or unexpected system instability. Red Hat rates this flaw with a CVSS 3.1 score of 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), reflecting the high attack complexity of reliably triggering the timing issue, whereas the upstream CVEORG score is 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Red Hat Enterprise Linux 6 and 7 Extended Life Cycle Support streams (kernel and kernel-rt) are not affected because the vulnerable code is not present in those kernels. Fixes for the affected product streams are being pursued.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | kernel | Affected | ||
| Red Hat Enterprise Linux 6 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 9 | kernel | Affected | ||
| Red Hat Enterprise Linux 9 | kernel-rt | Affected | ||
| Red Hat OpenShift Container Platform 4 | openshift/ose-rhel-coreos-8 | Affected | ||
| Red Hat OpenShift Container Platform 4 | openshift/ose-rhel-coreos-9 | Affected | ||
| Red Hat Enterprise Linux 8 | kernel-rt | Fixed | RHSA-2026:85774 | 20.10.2026 |
| Red Hat Enterprise Linux 8 | kernel | Fixed | RHSA-2026:85773 | 20.10.2026 |
Показывать по
Дополнительная информация
Статус:
EPSS
7 High
CVSS3
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: hold reference on ct until flow is released nf_ct_put() releases the ct->ext area inmediately, the rcu typesafe semantics also allow to refer to the wrong conntrack from the flowtable datapath. Hold reference on ct until flow is released after rcu grace period. Add rcu_barrier() on module exit path, to ensure pending flow entries are release before module goes away.
In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: hold reference on ct until flow is released nf_ct_put() releases the ct->ext area inmediately, the rcu typesafe semantics also allow to refer to the wrong conntrack from the flowtable datapath. Hold reference on ct until flow is released after rcu grace period. Add rcu_barrier() on module exit path, to ensure pending flow entries are release before module goes away.
netfilter: flowtable: hold reference on ct until flow is released
In the Linux kernel, the following vulnerability has been resolved: n ...
In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: hold reference on ct until flow is released nf_ct_put() releases the ct->ext area inmediately, the rcu typesafe semantics also allow to refer to the wrong conntrack from the flowtable datapath. Hold reference on ct until flow is released after rcu grace period. Add rcu_barrier() on module exit path, to ensure pending flow entries are release before module goes away.
EPSS
7 High
CVSS3