Executive brief
The Linux kernel's netfilter subsystem (used for packet filtering and network address translation in firewalls and routers) has a bug where set expressions are cloned twice during element insertion, leading to a module refcount imbalance. This causes a kernel warning splat and can destabilize firewall rule processing, particularly when using connection-limiting rules.
Technical details
The vulnerability is a logic error in the netfilter nf_tables framework where both the dynset and newsetelem paths clone existing set expressions redundantly—once to clone template expressions and again on the new element. This double clone only occurs when userspace does not provide override expressions. The fix adds an override_exprs flag to distinguish user-provided override expressions from template expressions, avoiding the redundant clone and correctly managing memory. The bug manifests as a module refcount imbalance warning when using the connlimit expression with default set expressions. The vulnerability is local to the kernel and requires CAP_NET_ADMIN to exploit; no remote attack vector exists. Patches have been released upstream.
Affected products
- Linux Linux kernel affected versions prior to fix commit 43559058d21e0493aa220ac167e0279334dea5f9
Timeline
- 2026-09-17: disclosed: CVE-2026-90061 published
- 2026-08-27: patched: Upstream fix committed by Pablo Neira Ayuso
- 2026-08-19: other: Fix authored