Lucene search

K
cvelistLinuxCVELIST:CVE-2024-26925
HistoryApr 24, 2024 - 9:49 p.m.

CVE-2024-26925 netfilter: nf_tables: release mutex after nft_gc_seq_end from abort path

2024-04-2421:49:23
Linux
raw.githubusercontent.com
2
linux kernel
netfilter
nf_tables
mutex
gc sequence
module dependencies

6.4 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

10.0%

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_tables: release mutex after nft_gc_seq_end from abort path

The commit mutex should not be released during the critical section
between nft_gc_seq_begin() and nft_gc_seq_end(), otherwise, async GC
worker could collect expired objects and get the released commit lock
within the same GC sequence.

nf_tables_module_autoload() temporarily releases the mutex to load
module dependencies, then it goes back to replay the transaction again.
Move it at the end of the abort phase after nft_gc_seq_end() is called.

6.4 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

10.0%