Executive brief
The Linux kernel's netfilter ipset module has a flaw in how it stops garbage collection (cleanup) when destroying network filtering rule sets. When a set is destroyed, the garbage collector may continue trying to reschedule itself, preventing proper cleanup and potentially causing system resource leaks or denial of service. This affects systems using advanced network filtering and IP set management.
Technical details
The vulnerability exists in the netfilter ipset module's garbage collection (gc) shutdown logic. When a set is destroyed, cancel_delayed_work_sync() is called to stop the gc task, but gc unconditionally calls queue_delayed_work() which can cause the gc work to be requeued even during shutdown, preventing proper termination. The fix changes cancel_delayed_work_sync() to disable_delayed_work_sync() in the mtype_cancel_gc() function (net/netfilter/ipset/ip_set_hash_gen.h) to ensure gc is properly disabled before destruction. This is a race condition affecting kernel versions with the vulnerable gc implementation. The patch is available in the kernel stable tree.
Affected products
- Linux Linux kernel multiple versions (see kernel git stable tree)
Timeline
- 2026-08-15: disclosed
- 2026-06-17: patched: Upstream fix committed; backported to stable branches
- 2026-06-21: other: Merged to netfilter tree