Riskcovery

CVE-2022-48643

netfilter: nf_tables: fix nft_counters_enabled underflow at nf_tables_addchain()

State
Published
Severity
Not scored
Published
Apr 28, 2024
Updated
May 11, 2026
Reserved
Feb 25, 2024

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_tables: fix nft_counters_enabled underflow at nf_tables_addchain()

syzbot is reporting underflow of nft_counters_enabled counter at nf_tables_addchain() [1], for commit 43eb8949cfdffa76 ("netfilter: nf_tables: do not leave chain stats enabled on error") missed that nf_tables_chain_destroy() after nft_basechain_init() in the error path of nf_tables_addchain() decrements the counter because nft_basechain_init() makes nft_is_base_chain() return true by setting NFT_CHAIN_BASE flag.

Increment the counter immediately after returning from nft_basechain_init().

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • c907dfe4eaca9665694a0340de1458a093abe354 to before 710e3f526bd23a0d33435dedc52c3144de284378Affected
  • 6d7ddee503951641f3ec6f0e3269446970bbcdab to before 91aa52652f4b37089aff3cb53e83049d826fef6dAffected
  • 98a621ef45e3605c7487f7fa6fec7df94697d6a2 to before 8bcad2a931313aeba076b76922d5813ef97d0a91Affected
  • 43eb8949cfdffa764b92bc6c54b87cbe5b0003fe to before 921ebde3c0d22c8cba74ce8eb3cc4626abff1ccdAffected
LinuxLinux
  • 5.10.140 to before 5.10.146Affected
  • 5.15.64 to before 5.15.71Affected
  • 5.19.6 to before 5.19.12Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.