From: Sasha Levin <sashal@kernel.org>
To: Sid Kumar <sidkumar1@gmail.com>,
stable@vger.kernel.org, Pablo Neira Ayuso <pablo@netfilter.org>
Cc: Sasha Levin <sashal@kernel.org>,
Vegard Nossum <vegard.nossum@oracle.com>,
Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
Jakub Acs <acsjakub@amazon.de>,
Jiayuan Chen <jiayuan.chen@linux.dev>
Subject: Re: [PATCH 5.15.y] netfilter: nf_tables: restore set elements when delete set fails
Date: Tue, 21 Jul 2026 08:08:39 -0400 [thread overview]
Message-ID: <20260721120236.100005-1-sashal@kernel.org> (raw)
In-Reply-To: <afa30b9a-07fb-4f21-973a-72bc7ceeb9e4@linux.dev>
On Tue, Jul 21, 2026 at 05:07:00PM +0800, Jiayuan Chen wrote:
>Is this patch associated with cve-2026-23111
>(https://fuzzinglabs.com/repro-cve-2026-23111/) ?
No - this patch is the 5.15 backport of the CVE-2024-27012 fix
(upstream e79b47a8615d), a different vulnerability. CVE-2026-23111 is
the inverted genmask check in nft_map_catchall_activate(), fixed
upstream by f41c5d151078 ("netfilter: nf_tables: fix inverted genmask
check in nft_map_catchall_activate()"), and that fix is already in
linux-5.15.y as commit 8c760ba4e36c (released back in February).
>I'm verifying cve-2026-23111 in latest 5.15 stable, but I can still get
>garbled text by running 'nft list maps' like this:
[...]
>Does that means cve-2026-23111 is still exist in latest 5.15 ?
I don't believe so. What you're most likely reproducing is
CVE-2024-27012 itself: released 5.15.y still lacks this patch, so
nft_map_catchall_activate() doesn't restore catchall map elements on
the abort path (there's no nft_clear() there), which leaves a freed
element visible to 'nft list maps'. That's exactly the bug this
backport fixes, and it doesn't reintroduce the inverted check - the
nft_set_elem_active() test it builds on is the corrected one.
So this patch stays queued for 5.15. Could you retest with it applied
and confirm the UAF is gone?
--
Thanks,
Sasha
next prev parent reply other threads:[~2026-07-21 12:08 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-06-24 21:36 [PATCH 5.15.y] netfilter: nf_tables: restore set elements when delete set fails Sid Kumar
2026-07-21 9:07 ` Jiayuan Chen
2026-07-21 12:08 ` Sasha Levin [this message]
2026-07-21 12:31 ` Jiayuan Chen
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260721120236.100005-1-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=acsjakub@amazon.de \
--cc=gregkh@linuxfoundation.org \
--cc=jiayuan.chen@linux.dev \
--cc=pablo@netfilter.org \
--cc=sidkumar1@gmail.com \
--cc=stable@vger.kernel.org \
--cc=vegard.nossum@oracle.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.