Executive brief
A vulnerability was identified in the Linux kernel's networking subsystem, specifically within the 'ipset' component used for managing firewall rules. An error in how the system cleans up empty data structures could lead to resource management issues. This could allow a local user to cause a system crash or instability, resulting in a denial of service.
Technical details
A vulnerability exists in the netfilter ipset implementation within the Linux kernel. The function mtype_del() incorrectly evaluates when a hash bucket is empty; it previously only dropped a bucket when both the position pointer (n->pos) and the count of empty slots (k) were zero. This logic failed to account for buckets where all live entries were removed but the position pointer remained non-zero. An attacker with local access could potentially exploit this improper resource cleanup to cause a denial of service. The fix updates the logic to treat a bucket as empty when the count of unused slots matches the current position, ensuring the bucket is released correctly.
Affected products
- Linux Linux Kernel 5.5.8 to 5.6, 5.11 to 5.15.203, 5.6.1 to 5.10.253, 6.13 to 6.18.22, 5.16 to 6.1.168, 6.19 to 6.19.12, 6.7 to 6.12.81, 6.2 to 6.6.134, 5.4.24 to 5.5
Timeline
- 2026-04-13: disclosed
- 2026-04-13: advisory
- 2026-04-18: patched
References
- https://git.kernel.org/stable/c/58f3a14826d4e6b0d5421f1a64be280b48601ea2
- https://git.kernel.org/stable/c/68ca0eea0af02bed36c5e2c13e9fa1647c31a7d4
- https://git.kernel.org/stable/c/6cea34d7ec6829b62f521a37a287f670144a2233
- https://git.kernel.org/stable/c/9862ef9ab0a116c6dca98842aab7de13a252ae02
- https://git.kernel.org/stable/c/ad92ee87462f9a3061361d392e9dbfe2e5c1c9fb
- https://git.kernel.org/stable/c/b7eef00f08b92b0b9efe8ae0df6d0005e6199323
- https://git.kernel.org/stable/c/c098ff857e7ca923539164af5b3c2fe3e8f8afaf