Executive brief
A vulnerability was identified in the Linux kernel's netfilter component, which manages network traffic filtering and firewall rules. Under specific conditions involving simultaneous firewall rule resets and IP set listings, the system could experience a circular lock dependency, potentially leading to a system hang or denial of service. This issue has been resolved by updating how the kernel handles concurrent reset requests.
Technical details
A circular lock dependency exists in the nf_tables component of the Linux kernel between commit_mutex, nfnl_subsys_ipset, and nlk_cb_mutex. This race condition is triggered when 'nft reset', 'ipset list', and 'iptables-nft' with '-m set' rules are executed simultaneously. The root cause was the unnecessary use of commit_mutex in the reset path, which was originally intended to prevent counter underruns but is no longer required due to previous concurrency improvements. An attacker with local access could potentially trigger this deadlock to cause a denial of service. The fix involves reverting the commit_mutex usage in the reset path.
Affected products
- Linux Linux Kernel All versions prior to the fix in netfilter nf_tables
Timeline
- 2026-02-04: other: Patch authored by Brian Witte
- 2026-05-27: disclosed: CVE published to NVD