Executive brief
The Linux kernel's netfilter ipset module, used to manage IP address sets for firewall rules, contained a race condition in its comment extension handling. An attacker with local access could exploit this timing vulnerability to cause a kernel crash or potentially execute arbitrary code, disrupting network filtering and potentially allowing unauthorized traffic through the firewall.
Technical details
The vulnerability is a use-after-free caused by incorrect ordering of RCU (Read-Copy-Update) operations in the ipset comment extension code. Specifically, kfree_rcu() was being called before rcu_assign_pointer(), violating RCU synchronization semantics. This allows readers accessing the pointer during the window between deallocation and reassignment to encounter freed memory. The vulnerability exists in ip_set_init_comment() and ip_set_comment_free() functions in net/netfilter/ipset/ip_set_core.c. Exploitation requires local kernel access to interact with ipset operations. The fix reorders the operations to call rcu_assign_pointer() first (safely nullifying the pointer) before freeing the old data structure.
Affected products
- Linux Linux Kernel 2.6.11 through 7.2 (affected versions vary by stable tree)
Timeline
- 2026-08-15: disclosed
- 2026-06-21: patched: Patch commit 3ca9982a8882470aa0ac4e8bb9a552b181d1efcd merged to mainline