Executive brief
The Linux kernel's netfilter component, which enforces network firewall and packet filtering rules, contains a reference counting bug in its nf_tables subsystem. During error handling when adding set elements, a reference counter for chains is incorrectly decremented twice, leading to memory corruption and potential kernel crashes or privilege escalation on systems running affected kernel versions.
Technical details
This vulnerability exists in the set element addition error path within net/netfilter/nf_tables_api.c. The bug involves a double-decrement of chain reference counters: once during element release and again via nft_data_release(). A prior patch (d6b478666ffa) attempted to fix a related object reference counter underflow but incorrectly removed the stateful object decrement, allowing the chain counter to be decremented twice. The fix restores the stateful object decrement while ensuring nft_data_release() handles chain counter decrements, so this occurs only once. This is a kernel-level memory management issue that requires no special privileges to trigger, though exploitability depends on kernel memory isolation and attack surface.
Affected products
- Linux Linux kernel Multiple versions (fix backported to stable trees from 4.14.y through 6.19.y and rolling branches)
Timeline
- 2025-12-24: disclosed
- 2023-06-26: patched: Upstream fix committed; stable tree backports from 2023-07-19 onwards