Re: [BUG] netfilter: nf_tables_netdev_event UAF of JUMP binding chain

[Florian Westphal <fw@strlen.de>]

Yu Junzhe <junzheyu1@gmail.com> wrote:
> I am reporting a slab use-after-free in nf_tables_netdev_event(): deleting
> a netdev hooked by an nftables ingress base chain can free a binding-chain
> successor while the notifier is still walking table->chains. Triggering it
> requires CAP_NET_ADMIN (including in a network namespace). I do not claim
> privilege escalation; the result we see is local DoS (KASAN slab UAF read).
> 
> Summary
> =======
> 
> nf_tables_netdev_event() walks table->chains with list_for_each_entry_safe.
> On NETDEV_UNREGISTER it releases the netdev ingress base chain. A JUMP to an
> NFT_CHAIN_BINDING successor is deactivated (nft_chain_del + bound = false)
> and then nft_immediate_destroy() kfree's that successor. The walker's saved
> nr still points at the freed nft_chain, so the loop increment reads
> chain->list.next.
> 
> The deactivate/destroy path:
> 
>   __nft_release_basechain_now()
>     -> nft_rule_expr_deactivate(..., NFT_TRANS_RELEASE)
>     -> nft_immediate_deactivate(): nft_chain_del(chain); chain->bound = false;
>     -> nft_immediate_destroy(): nf_tables_chain_destroy() when !chain->bound
> 
> list_for_each_entry_safe only protects deleting the current entry, not a
> sibling freed inside the loop body.
> 
> Affected
> ========
> 
> - Confirmed on Linux 6.6.144, KASAN guest.
> - Files: net/netfilter/nft_chain_filter.c, net/netfilter/nft_immediate.c,
>   net/netfilter/nf_tables_api.c
> - Config: CONFIG_NF_TABLES=y, CONFIG_NF_TABLES_NETDEV=y, CONFIG_BRIDGE=y
>   (KASAN used for the report)
> - Source review of torvalds/linux master as of 2026-09-18:
>   nft_immediate_deactivate() still unlinks binding chains on NFT_TRANS_RELEASE
>   and nft_immediate_destroy() still destroys them when !chain->bound.
>   __nft_release_basechain() is gone from nf_tables_api.c and the notifier
>   only unregisters hooks on tip, so this PoC's live RTM_DELLINK trigger was
>   not re-run on tip.
> 
> Ruleset that triggers it
> ========================
> 
>   table netdev t {
>           chain in {
>                   type filter hook ingress device "br0" priority 0;
>                   jump j
>           }
>           chain j {
>                   flags binding;
>           }
>   }

nft fails to parse "binding" here.

> Create br0 in a network namespace, load the ruleset, then RTM_DELLINK br0
> while the namespace is still alive (NETDEV_UNREGISTER). Netns teardown alone
> is too late: nft pernet exit wins that race.
> 
> Crash excerpt (minimized PoC, Linux 6.6.144 KASAN)
> ==================================================

We don't  handle 6.6.144 or other -stable kernels.
Please check current kernels, either linux.git , net.git or nf.git.

If the problem exists there, then please report back with
a working reproducer.