In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() nft_map_catchall_activate() has an inverted element activity check compared to its non-catchall counterpart nft_mapelem_activate() and compared to what is logically required. nft_map_catchall_activate() is called from the abort path to re-activate catchall map elements that were deactivated during a failed transaction. It should skip elements that are already active (they don't need re-activation) and process elements that are inactive (they need to be restored). Instead, the current code does the opposite: it skips inactive elements and processes active ones. Compare the non-catchall activate callback, which is correct: nft_mapelem_activate(): if (nft_set_elem_active(ext, iter->genmask)) return 0; /* skip active, process inactive */ With the buggy catchall version: nft_map_catchall_activate(): if (!nft_set_e...

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() nft_map_catchall_activate() has an inverted element activity check compared to its non-catchall counterpart nft_mapelem_activate() and compared to what is logically required. nft_map_catchall_activate() is called from the abort path to re-activate catchall map elements that were deactivated during a failed transaction. It should skip elements that are already active (they don't need re-activation) and process elements that are inactive (they need to be restored). Instead, the current code does the opposite: it skips inactive elements and processes active ones. Compare the non-catchall activate callback, which is correct: nft_mapelem_activate(): if (nft_set_elem_active(ext, iter->genmask)) return 0; /* skip active, process inactive */ With the buggy catchall version: nft_map_catchall_activate(): if (!nft_set_elem_active(ext, genmask)) c...

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() nft_map_catchall_activate() has an inverted element activity check compared to its non-catchall counterpart nft_mapelem_activate() and compared to what is logically required. nft_map_catchall_activate() is called from the abort path to re-activate catchall map elements that were deactivated during a failed transaction. It should skip elements that are already active (they don't need re-activation) and process elements that are inactive (they need to be restored). Instead, the current code does the opposite: it skips inactive elements and processes active ones. Compare the non-catchall activate callback, which is correct: nft_mapelem_activate(): if (nft_set_elem_active(ext, iter->genmask)) return 0; /* skip active, process inactive */ With the buggy catchall version: nft_map_catchall_activate(): if (!nft_set_elem_active(ext, genmask)) c...

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() nft_map_catchall_activate() has an inverted element activity check compared to its non-catchall counterpart nft_mapelem_activate() and compared to what is logically required. nft_map_catchall_activate() is called from the abort path to re-activate catchall map elements that were deactivated during a failed transaction. It should skip elements that are already active (they don't need re-activation) and process elements that are inactive (they need to be restored). Instead, the current code does the opposite: it skips inactive elements and processes active ones. Compare the non-catchall activate callback, which is correct: nft_mapelem_activate(): if (nft_set_elem_active(ext, iter->genmask)) return 0; /* skip active, process inactive */ With the buggy catchall version: nft_map_catchall_activate(): if (!nft_set_elem

In the Linux kernel, the following vulnerability has been resolved: n ...

Уязвимость функции nft_map_catchall_activate() компонента nf_tables ядра операционной системы Linux, позволяющая нарушителю вызвать отказ в обслуживании

Security update for the Linux Kernel (Live Patch 20 for SUSE Linux Enterprise 15 SP6)

Security update for the Linux Kernel (Live Patch 9 for SUSE Linux Enterprise 15 SP7)

Security update for the Linux Kernel RT (Live Patch 9 for SUSE Linux Enterprise 15 SP7)

Moderate: kernel security update

ELSA-2026-6570: kernel security update (MODERATE)

Security update for the Linux Kernel (Live Patch 7 for SUSE Linux Enterprise 15 SP7)

Security update for the Linux Kernel (Live Patch 8 for SUSE Linux Enterprise 15 SP7)

Security update for the Linux Kernel (Live Patch 19 for SUSE Linux Enterprise 15 SP6)

Security update for the Linux Kernel (Live Patch 18 for SUSE Linux Enterprise 15 SP6)

Security update for the Linux Kernel RT (Live Patch 8 for SUSE Linux Enterprise 15 SP7)

Security update for the Linux Kernel (Live Patch 6 for SUSE Linux Enterprise 15 SP7)

Security update for the Linux Kernel RT (Live Patch 6 for SUSE Linux Enterprise 15 SP7)

Security update for the Linux Kernel (Live Patch 0 for SUSE Linux Enterprise 15 SP7)

Security update for the Linux Kernel (Live Patch 5 for SUSE Linux Enterprise 15 SP7)