Description

In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: do not update comments from kernel-side hash adds mtype_resize() copies comment pointers with memcpy(), not the comment objects themselves. During the window after an entry has been copied but before the table swap and backlog replay, the old table is still published for packet-side updates while the replacement-table entry already holds the same ip_set_comment_rcu pointer. If xt_SET --add-set ... --exist hits that old entry in this window, mtype_add() calls ip_set_init_comment() even though packet-side adds carry no comment payload. That call frees the shared comment through the old entry, so the replacement-table entry now holds a stale pointer. When the queued add is replayed on the new table, mtype_add() calls ip_set_init_comment() again and strlen() dereferences the stale pointer. Fix this in mtype_add() by skipping ip_set_init_comment() when ext->target marks a packet-side add. Userspace adds still update comments, while packet-side adds can no longer free comment storage shared with a resize copy.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.4",
  "pubDate": "2026-08-15T13:17:54.120Z",
  "pubdate": "2026-08-15T13:17:54.120Z",
  "executiveSummary": "A use-after-free vulnerability exists in the Linux kernel netfilter ipset subsystem, specifically within the hash set resize and comment management logic. The vulnerability arises during table resizing operations when comment pointers are shallow-copied using memcpy() rather than deep-copied, creating a shared pointer race condition between the old active table and the new replacement table.\nAn attacker or local process capable of interacting with netfilter ipset can trigger this flaw by concurrently executing hash set resizing operations and kernel-side set additions using the xt_SET target with the --exist flag. Successful exploitation leads to a double-free or use-after-free condition of the ip_set_comment_rcu memory objects, potentially causing kernel crashes, memory corruption, or local denial of service.\nThe vulnerability affects systems utilizing the Linux kernel netfilter ipset module where hash sets are configured with comments and subjected to concurrent resize operations and packet-side set insertions. Exploitation requires the ability to trigger netfilter operations and race the window between table copying, table swapping, and backlog replay.\nRisk implications include system instability and potential kernel execution hijacking if memory corruption can be reliably controlled. Mitigation requires applying the official kernel patch that prevents packet-side additions from improperly initializing and freeing shared comment storage during resize windows.",
  "technicalDetails": "The vulnerability is located in the netfilter ipset subsystem of the Linux kernel, specifically within the mtype_resize() and mtype_add() functions governing hash set management and extension handling.\nDuring the execution of mtype_resize(), comment pointers associated with set entries are copied to the replacement table using a shallow memcpy() operation rather than duplicating the underlying comment objects. This introduces a synchronization window between the moment an entry is copied into the replacement table and the finalization of the table swap and backlog replay. Throughout this window, the old table remains active and published for packet-side updates, while the entry in the replacement table concurrently holds an identical ip_set_comment_rcu pointer pointing to the same shared comment structure.\nIf a packet-side update utilizing the xt_SET target with the --exist flag hits the old table entry during this precise operational window, mtype_add() executes ip_set_init_comment(). This occurs despite packet-side adds carrying no valid comment payload. Consequently, this function prematurely frees the shared comment memory via the old table entry, leaving the corresponding entry in the replacement table referencing a stale, dangling pointer.\nSubsequently, when the queued add operation is replayed onto the new table, mtype_add() invokes ip_set_init_comment() a second time. This triggers a strlen() dereference operation on the already freed, stale pointer, resulting in a use-after-free condition and subsequent kernel memory corruption or kernel panic.\nPrerequisites for this attack flow include local or network packet generation capability that traverses the netfilter framework and invokes the xt_SET target with the --exist modifier against a hash set undergoing concurrent resizing operations. No special privileges beyond standard netfilter interaction capabilities are explicitly required to trigger packet-side adds, though setting up the race condition requires precise timing between userspace-driven resizes and packet processing."
}