Re: [PATCH 5.15.y] netfilter: nf_tables: restore set elements when delete set fails

[Jiayuan Chen <jiayuan.chen@linux.dev>]

On 7/21/26 8:08 PM, Sasha Levin wrote:
> On Tue, Jul 21, 2026 at 05:07:00PM +0800, Jiayuan Chen wrote:
>> Is this patch associated with cve-2026-23111
>> (https://fuzzinglabs.com/repro-cve-2026-23111/) ?
> No - this patch is the 5.15 backport of the CVE-2024-27012 fix
> (upstream e79b47a8615d), a different vulnerability. CVE-2026-23111 is
> the inverted genmask check in nft_map_catchall_activate(), fixed
> upstream by f41c5d151078 ("netfilter: nf_tables: fix inverted genmask
> check in nft_map_catchall_activate()"), and that fix is already in
> linux-5.15.y as commit 8c760ba4e36c (released back in February).
>
>> I'm verifying cve-2026-23111 in latest 5.15 stable, but I can still get
>> garbled text by running 'nft list maps' like this:
> [...]
>> Does that means cve-2026-23111 is still exist in latest 5.15 ?
> I don't believe so. What you're most likely reproducing is
> CVE-2024-27012 itself: released 5.15.y still lacks this patch, so
> nft_map_catchall_activate() doesn't restore catchall map elements on
> the abort path (there's no nft_clear() there), which leaves a freed
> element visible to 'nft list maps'. That's exactly the bug this
> backport fixes, and it doesn't reintroduce the inverted check - the
> nft_set_elem_active() test it builds on is the corrected one.
>
> So this patch stays queued for 5.15. Could you retest with it applied
> and confirm the UAF is gone?

Yes, after applying this thread, the UAF disappeared.

Operation 'nft delete chain inet mytable mychain' will rejected just 
like 6.6 did (I'm also testing 6.6 stable).


~# FILE_BASH="file_bash"
~# nft flush ruleset
~# rm -f "$FILE_BASH"
~# nft add table inet mytable
~# nft add chain inet mytable mychain
~# nft add map inet mytable mymap { type ipv4_addr : verdict \; }
~# nft add element inet mytable mymap { \* : goto mychain }
~# nft add map inet mytable triggermap { type ipv4_addr : verdict \; }
~# nft add element inet mytable triggermap { \* : goto mychain }
~# cat > "$FILE_BASH" << 'BATCH_CONTENT'
delete map inet mytable triggermap
delete map inet mytable bonjour
BATCH_CONTENT

~# nft -f "$FILE_BASH"
file_bash:2:25-31: Error: Could not process rule: No such file or directory
delete map inet mytable bonjour
                         ^^^^^^^
~# nft delete map inet mytable mymap
~# nft delete chain inet mytable mychain
Error: Could not process rule: Device or resource busy
delete chain inet mytable mychain
                           ^^^^^^^
~# nft list chains
table inet mytable {
     chain mychain {
     }
}
~# nft list maps
table inet mytable {
     map triggermap {
         type ipv4_addr : verdict
         elements = { * : goto mychain }
     }
}