[BUG] netfilter: nf_tables_netdev_event UAF of JUMP binding chain

[BUG] netfilter: nf_tables_netdev_event UAF of JUMP binding chain

[Yu Junzhe]

Hello,

I am reporting a slab use-after-free in nf_tables_netdev_event(): deleting
a netdev hooked by an nftables ingress base chain can free a binding-chain
successor while the notifier is still walking table->chains. Triggering it
requires CAP_NET_ADMIN (including in a network namespace). I do not claim
privilege escalation; the result we see is local DoS (KASAN slab UAF read).

Summary
=======

nf_tables_netdev_event() walks table->chains with list_for_each_entry_safe.
On NETDEV_UNREGISTER it releases the netdev ingress base chain. A JUMP to an
NFT_CHAIN_BINDING successor is deactivated (nft_chain_del + bound = false)
and then nft_immediate_destroy() kfree's that successor. The walker's saved
nr still points at the freed nft_chain, so the loop increment reads
chain->list.next.

The deactivate/destroy path:

  __nft_release_basechain_now()
    -> nft_rule_expr_deactivate(..., NFT_TRANS_RELEASE)
    -> nft_immediate_deactivate(): nft_chain_del(chain); chain->bound = false;
    -> nft_immediate_destroy(): nf_tables_chain_destroy() when !chain->bound

list_for_each_entry_safe only protects deleting the current entry, not a
sibling freed inside the loop body.

Affected
========

- Confirmed on Linux 6.6.144, KASAN guest.
- Files: net/netfilter/nft_chain_filter.c, net/netfilter/nft_immediate.c,
  net/netfilter/nf_tables_api.c
- Config: CONFIG_NF_TABLES=y, CONFIG_NF_TABLES_NETDEV=y, CONFIG_BRIDGE=y
  (KASAN used for the report)
- Source review of torvalds/linux master as of 2026-09-18:
  nft_immediate_deactivate() still unlinks binding chains on NFT_TRANS_RELEASE
  and nft_immediate_destroy() still destroys them when !chain->bound.
  __nft_release_basechain() is gone from nf_tables_api.c and the notifier
  only unregisters hooks on tip, so this PoC's live RTM_DELLINK trigger was
  not re-run on tip.

Ruleset that triggers it
========================

  table netdev t {
          chain in {
                  type filter hook ingress device "br0" priority 0;
                  jump j
          }
          chain j {
                  flags binding;
          }
  }

Create br0 in a network namespace, load the ruleset, then RTM_DELLINK br0
while the namespace is still alive (NETDEV_UNREGISTER). Netns teardown alone
is too late: nft pernet exit wins that race.

Crash excerpt (minimized PoC, Linux 6.6.144 KASAN)
==================================================

BUG: KASAN: slab-use-after-free in nf_tables_netdev_event+0x699/0x7d0
Read of size 8 at addr ff11000009aefd20 by task repro/220
CPU: 0 PID: 220 Comm: repro Not tainted 6.6.144 #1
Call Trace:
  kasan_report
  nf_tables_netdev_event+0x699/0x7d0
  notifier_call_chain
  unregister_netdevice_many_notify
  rtnl_dellink
  rtnetlink_rcv_msg
Allocated by task 220:
  nf_tables_addchain
  nf_tables_newchain
Freed by task 220:
  nf_tables_chain_destroy
  nft_immediate_destroy
  __nft_release_basechain_now
  __nft_release_basechain
  nf_tables_netdev_event+0x63a/0x7d0

The KASAN read is 8 bytes at offset 32 of a kmalloc-128 object (nft_chain.list).

Reproducer
==========

A self-contained C PoC (raw NETLINK_NETFILTER batch plus RTM_NEWLINK/
RTM_DELLINK, no nft binary) and a Docker/QEMU package are available on
request. VM-only: the program triggers a guest KASAN UAF. Please do not run
it on a host kernel.

I am happy to test patches or send the reproducer.

Thanks,
Yu Junzhe
FuzzAnything <fuzzanything@gmail.com>

Re: [BUG] netfilter: nf_tables_netdev_event UAF of JUMP binding chain

[Florian Westphal]

Yu Junzhe <junzheyu1@gmail.com> wrote:
> I am reporting a slab use-after-free in nf_tables_netdev_event(): deleting
> a netdev hooked by an nftables ingress base chain can free a binding-chain
> successor while the notifier is still walking table->chains. Triggering it
> requires CAP_NET_ADMIN (including in a network namespace). I do not claim
> privilege escalation; the result we see is local DoS (KASAN slab UAF read).
> 
> Summary
> =======
> 
> nf_tables_netdev_event() walks table->chains with list_for_each_entry_safe.
> On NETDEV_UNREGISTER it releases the netdev ingress base chain. A JUMP to an
> NFT_CHAIN_BINDING successor is deactivated (nft_chain_del + bound = false)
> and then nft_immediate_destroy() kfree's that successor. The walker's saved
> nr still points at the freed nft_chain, so the loop increment reads
> chain->list.next.
> 
> The deactivate/destroy path:
> 
>   __nft_release_basechain_now()
>     -> nft_rule_expr_deactivate(..., NFT_TRANS_RELEASE)
>     -> nft_immediate_deactivate(): nft_chain_del(chain); chain->bound = false;
>     -> nft_immediate_destroy(): nf_tables_chain_destroy() when !chain->bound
> 
> list_for_each_entry_safe only protects deleting the current entry, not a
> sibling freed inside the loop body.
> 
> Affected
> ========
> 
> - Confirmed on Linux 6.6.144, KASAN guest.
> - Files: net/netfilter/nft_chain_filter.c, net/netfilter/nft_immediate.c,
>   net/netfilter/nf_tables_api.c
> - Config: CONFIG_NF_TABLES=y, CONFIG_NF_TABLES_NETDEV=y, CONFIG_BRIDGE=y
>   (KASAN used for the report)
> - Source review of torvalds/linux master as of 2026-09-18:
>   nft_immediate_deactivate() still unlinks binding chains on NFT_TRANS_RELEASE
>   and nft_immediate_destroy() still destroys them when !chain->bound.
>   __nft_release_basechain() is gone from nf_tables_api.c and the notifier
>   only unregisters hooks on tip, so this PoC's live RTM_DELLINK trigger was
>   not re-run on tip.
> 
> Ruleset that triggers it
> ========================
> 
>   table netdev t {
>           chain in {
>                   type filter hook ingress device "br0" priority 0;
>                   jump j
>           }
>           chain j {
>                   flags binding;
>           }
>   }

nft fails to parse "binding" here.

> Create br0 in a network namespace, load the ruleset, then RTM_DELLINK br0
> while the namespace is still alive (NETDEV_UNREGISTER). Netns teardown alone
> is too late: nft pernet exit wins that race.
> 
> Crash excerpt (minimized PoC, Linux 6.6.144 KASAN)
> ==================================================

We don't  handle 6.6.144 or other -stable kernels.
Please check current kernels, either linux.git , net.git or nf.git.

If the problem exists there, then please report back with
a working reproducer.