Description

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: publish GC-visible tuple last nf_flow_table_iterate() only treats original-direction tuple nodes as owning entries. Publishing the original node first lets GC observe and free a flow while flow_offload_add() is still inserting the reply node. Publish the reply node first and the original node last so GC never sees a partially installed flow. KASAN can trigger slab-use-after-free read and write reports in the flowtable/rhashtable path (rht_deferred_worker, jhash, flow_offload_del, flow_offload_lookup, etc.).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-26T15:16:53.503Z",
  "pubdate": "2026-08-26T15:16:53.503Z",
  "executiveSummary": "A race condition vulnerability exists within the Linux kernel's netfilter flowtable implementation, specifically concerning the insertion sequence of flow tuples.\nThe vulnerability is categorized as a synchronization flaw leading to a potential use-after-free (UAF) condition. It affects systems utilizing netfilter flowtables for network traffic offloading.\nThe issue arises because the original-direction tuple is published to the flowtable before the reply-direction tuple. This sequence allows the garbage collector (GC) to inspect and potentially free a flow entry that is only partially installed.\nAn attacker capable of triggering flowtable entries may exploit this timing window to cause memory corruption, leading to system instability, information disclosure, or potential arbitrary code execution via slab-use-after-free exploits.\nSuccessful exploitation requires the ability to interact with the netfilter flowtable subsystem, typically via packet injection or local network traffic manipulation. The risk is significant as it affects kernel memory integrity.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper ordering of tuple insertions during the flow_offload_add() operation within the netfilter flowtable infrastructure. In the Linux kernel, nf_flow_table_iterate() performs lookups and iterations based primarily on the original-direction tuple. When a new flow is introduced, the system must insert both the original and reply tuples into the rhashtable.\nPreviously, the logic published the original tuple node to the rhashtable prior to the reply tuple. Because the garbage collector (GC) relies on nf_flow_table_iterate() to identify and clean up stale entries, the premature publication of the original node renders the entire flow 'visible' to the GC while the insertion process is still incomplete. If the GC thread schedules a cleanup cycle while flow_offload_add() is still processing the reply node, the GC may identify the flow as invalid or subject to reclamation. If the GC triggers a deletion, it can invoke flow_offload_del() or other cleanup routines while the insertion path is still referencing or attempting to initialize the reply structure.\nThis race condition creates a use-after-free (UAF) scenario. Specifically, if the GC frees the memory associated with the flow structure, subsequent operations in the insertion path—such as rht_deferred_worker, jhash calculations, or further pointer dereferences—will access freed memory. KASAN reports have confirmed this behavior by flagging slab-use-after-free read and write operations during these contention points.\nThe exploitation flow proceeds as follows: 1) An attacker triggers the creation of a flow offload entry. 2) The kernel begins the insertion of the original tuple. 3) The original tuple becomes visible to the GC before the reply tuple is committed. 4) The GC thread preempts the execution, determines the flow is a candidate for deletion, and frees the associated memory. 5) The initial thread resumes, attempting to complete the insertion or finalize the reply tuple using pointers that now point to deallocated slab memory. The impact includes kernel panic due to memory corruption or potentially controlled heap manipulation if the attacker can influence the slab allocator's state post-free."
}