CVE-2026-74748: netfilter: ipset: fix refcount race between list:set GC and swap

CVE-2026-74748: netfilter: ipset: fix refcount race between list:set GC and swap

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

netfilter: ipset: fix refcount race between list:set GC and swap

__ip_set_put_byindex() resolved the index to a set pointer under RCU,
then took ip_set_ref_lock in __ip_set_put() to decrement set->ref.
ip_set_swap() holds that same lock while swapping both the ip_set_list
slots and the two sets' ref counters, so it can interleave between the
dereference and the lock acquisition, leaving the caller to decrement a
set whose reference already moved to the other index and hit
BUG_ON(set->ref == 0). list_set_gc() reaches this from timer softirq,
which the nfnl mutex does not serialize against swap: an expiring
list:set member calls list_set_del() -> ip_set_put_byindex() while
IPSET_CMD_SWAP runs on the referenced sets.

Resolve the index and decrement under ip_set_ref_lock, as ip_set_swap()
already does, keeping the refcount tied to the index rather than to a
stale set pointer.

  kernel BUG at net/netfilter/ipset/ip_set_core.c:685!
  Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI
  RIP: 0010:ip_set_put_byindex (net/netfilter/ipset/ip_set_core.c:870)
  Call Trace:
   <IRQ>
   list_set_del (net/netfilter/ipset/ip_set_list_set.c:159)
   set_cleanup_entries (net/netfilter/ipset/ip_set_list_set.c:181)
   list_set_gc (net/netfilter/ipset/ip_set_list_set.c:578)
   call_timer_fn (kernel/time/timer.c:1748)
   __run_timers (kernel/time/timer.c:1799 kernel/time/timer.c:2374)
   run_timer_softirq (kernel/time/timer.c:2405)
   </IRQ>
  Kernel panic - not syncing: Fatal exception in interrupt

The Linux kernel CVE team has assigned CVE-2026-74748 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 3.8 with commit 9076aea76538556224e7d73ab718f8841330818a and fixed in 5.10.266 with commit 97a01de0c6321b7210d30d0a4d60f10f561097c7
	Issue introduced in 3.8 with commit 9076aea76538556224e7d73ab718f8841330818a and fixed in 5.15.217 with commit c21afc7c216a4d257a4f3f300e0791890bc846b9
	Issue introduced in 3.8 with commit 9076aea76538556224e7d73ab718f8841330818a and fixed in 6.1.184 with commit b0aab9dd1a348b99d75ff52765719d0cc2050630
	Issue introduced in 3.8 with commit 9076aea76538556224e7d73ab718f8841330818a and fixed in 6.6.153 with commit b891e7a6bb06e0f6560e5932665ac660acd12225
	Issue introduced in 3.8 with commit 9076aea76538556224e7d73ab718f8841330818a and fixed in 6.12.105 with commit 20cb13a523f0a05cb2d0a7d72abae687683712e0
	Issue introduced in 3.8 with commit 9076aea76538556224e7d73ab718f8841330818a and fixed in 6.18.46 with commit cb20da33839f28f590c99f16bafaa6151451c0e8
	Issue introduced in 3.8 with commit 9076aea76538556224e7d73ab718f8841330818a and fixed in 7.1.10 with commit 24ffcb1e1688c55fd2a505f064295cd28eac546d
	Issue introduced in 3.8 with commit 9076aea76538556224e7d73ab718f8841330818a and fixed in 7.2 with commit 0c88868271653537ed443272dd8e7d13634d214b

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-74748
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/netfilter/ipset/ip_set_core.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/97a01de0c6321b7210d30d0a4d60f10f561097c7
	https://git.kernel.org/stable/c/c21afc7c216a4d257a4f3f300e0791890bc846b9
	https://git.kernel.org/stable/c/b0aab9dd1a348b99d75ff52765719d0cc2050630
	https://git.kernel.org/stable/c/b891e7a6bb06e0f6560e5932665ac660acd12225
	https://git.kernel.org/stable/c/20cb13a523f0a05cb2d0a7d72abae687683712e0
	https://git.kernel.org/stable/c/cb20da33839f28f590c99f16bafaa6151451c0e8
	https://git.kernel.org/stable/c/24ffcb1e1688c55fd2a505f064295cd28eac546d
	https://git.kernel.org/stable/c/0c88868271653537ed443272dd8e7d13634d214b