Executive brief
The Linux kernel's network traffic classification system (cls_u32) failed to properly clean up internal state when hardware filter programming failed. This could leave filter references in an inconsistent state, potentially causing kernel memory leaks, resource exhaustion, or denial of service in environments using hardware-offloaded traffic classification.
Technical details
A resource cleanup bug exists in the net/sched/cls_u32.c module where the tcf_bind_filter operation was not undone if the subsequent u32_replace_hw_knode call failed. The vulnerability arises from improper error handling in the u32_change function: when hardware offloading is attempted and fails, the binding state set by tcf_bind_filter remains active, causing a dangling reference. The fix extracts bind/unbind logic into dedicated functions and ensures u32_unbind_filter is called on error paths. The attack vector requires local network access to manipulate traffic classification rules, typically through netlink sockets. Patches were merged upstream by July 2023.
Affected products
- Linux Linux Kernel multiple versions affected; patched in kernel 6.4+
Timeline
- 2023-07-13: disclosed: Upstream commit by Victor Nogueira
- 2023-07-17: patched: Fix merged upstream by David S. Miller
- 2025-10-24: advisory: CVE-2023-53733 published