Vigie VulnDBEuropean-hosted Vulnerability DB
EN
Menu

netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (Linux Linux)

CVE-2026-23111
HIGH 7.8

En bref

Source
NVD
EPSS
EPSS 0.52 % · centile 44 ()
État
PUBLISHED
Publiée
Mise à jour
Attribuée par
Linux
Statut NVD
Modified

Rechercher sur…

Description

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() nft_map_catchall_activate() has an inverted element activity check compared to its non-catchall counterpart nft_mapelem_activate() and compared to what is logically required. nft_map_catchall_activate() is called from the abort path to re-activate catchall map elements that were deactivated during a failed transaction. It should skip elements that are already active (they don't need re-activation) and process elements that are inactive (they need to be restored). Instead, the current code does the opposite: it skips inactive elements and processes active ones. Compare the non-catchall activate callback, which is correct: nft_mapelem_activate(): if (nft_set_elem_active(ext, iter->genmask)) return 0; /* skip active, process inactive */ With the buggy catchall version: nft_map_catchall_activate(): if (!nft_set_elem_active(ext, genmask)) continue; /* skip inactive, process active */ The consequence is that when a DELSET operation is aborted, nft_setelem_data_activate() is never called for the catchall element. For NFT_GOTO verdict elements, this means nft_data_hold() is never called to restore the chain->use reference count. Each abort cycle permanently decrements chain->use. Once chain->use reaches zero, DELCHAIN succeeds and frees the chain while catchall verdict elements still reference it, resulting in a use-after-free. This is exploitable for local privilege escalation from an unprivileged user via user namespaces + nftables on distributions that enable CONFIG_USER_NS and CONFIG_NF_TABLES. Fix by removing the negation so the check matches nft_mapelem_activate(): skip active elements, process inactive ones.

Faiblesses (CWE)

  • CWE-416 — Utilisation après libération
  • CWE-672 — Opération sur une ressource expirée ou libérée

Références

Scores

VersionScoreVecteurÉvalué par
CVSS 3.1HIGH 7.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HLinux
CVSS 3.1HIGH 7.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hredhat-SADP
CVSS 3.1HIGH 7.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HNVD · 416baaa9-dc9f-4396-8d5f-8c081fb06d67 (Secondary)
CVSS 3.1HIGH 7.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HNVD · nvd@nist.gov (Primary)
CVSS 3.1HIGH 7.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HNVD · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c (Secondary)

Références européennes

Avis du CERT-FR

Configurations affectées (CPE NVD)

Produits affectés

ProduitVersions
Linux · Linuxaffected 25aa2ad37c2162be1c0bc4fe6397f7e4c13f00f8 < 8c760ba4e36c750379d13569f23f5a6e185333f5 ; affected d60be2da67d172aecf866302c91ea11533eca4d9 < b9b6573421de51829f7ec1cce76d85f5f6fbbd7f ; affected 628bd3e49cba1c066228e23d71a852c23e26da73 < 42c574c1504aa089a0a142e4c13859327570473d ; affected 628bd3e49cba1c066228e23d71a852c23e26da73 < 1444ff890b4653add12f734ffeffc173d42862dd ; affected 628bd3e49cba1c066228e23d71a852c23e26da73 < 8b68a45f9722f2babe9e7bad00aa74638addf081 ; affected 628bd3e49cba1c066228e23d71a852c23e26da73 < f41c5d151078c5348271ffaf8e7410d96f2d82f8
Linux · Linuxaffected 6.4 ; unaffected 0 < 6.4 ; unaffected 5.15.200 ≤ 5.15.* ; unaffected 6.1.163 ≤ 6.1.* ; unaffected 6.6.124 ≤ 6.6.* ; unaffected 6.12.70 ≤ 6.12.*

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD