CVE-2024-26834

netfilter: nft_flow_offload: release dst in case direct xmit path is used

State: Published
Severity: 7.5 High
Published: Apr 17, 2024
Updated: Aug 5, 2026
Reserved: Feb 19, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nft_flow_offload: release dst in case direct xmit path is used

Direct xmit does not use it since it calls dev_queue_xmit() to send packets, hence it calls dst_release().

kmemleak reports:

unreferenced object 0xffff88814f440900 (size 184): comm "softirq", pid 0, jiffies 4294951896 hex dump (first 32 bytes): 00 60 5b 04 81 88 ff ff 00 e6 e8 82 ff ff ff ff .`[............. 21 0b 50 82 ff ff ff ff 00 00 00 00 00 00 00 00 !.P............. backtrace (crc cb2bf5d6): [<000000003ee17107>] kmem_cache_alloc+0x286/0x340 [<0000000021a5de2c>] dst_alloc+0x43/0xb0 [<00000000f0671159>] rt_dst_alloc+0x2e/0x190 [<00000000fe5092c9>] __mkroute_output+0x244/0x980 [<000000005fb96fb0>] ip_route_output_flow+0xc0/0x160 [<0000000045367433>] nf_ip_route+0xf/0x30 [<0000000085da1d8e>] nf_route+0x2d/0x60 [<00000000d1ecd1cb>] nft_flow_route+0x171/0x6a0 [nft_flow_offload] [<00000000d9b2fb60>] nft_flow_offload_eval+0x4e8/0x700 [nft_flow_offload] [<000000009f447dbb>] expr_call_ops_eval+0x53/0x330 [nf_tables] [<00000000072e1be6>] nft_do_chain+0x17c/0x840 [nf_tables] [<00000000d0551029>] nft_do_chain_inet+0xa1/0x210 [nf_tables] [<0000000097c9d5c6>] nf_hook_slow+0x5b/0x160 [<0000000005eccab1>] ip_forward+0x8b6/0x9b0 [<00000000553a269b>] ip_rcv+0x221/0x230 [<00000000412872e5>] __netif_receive_skb_one_core+0xfe/0x110

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	7c71b831220edeab7ce603d818dc1708d9ea4137 to before 13b57b5cd591d5b22f9bbf047b2922967de411f3Affected 9c5662e95a8dcc232c3ef4deb21033badcd260f6 to before a6cafdb49a7bbf4a88367db209703eee6941e023Affected fa502c86566680ac62bc28ec883a069bf7a2aa5e to before 9256ab9232e35a16af9c30fa4e522e6d1bd3605aAffected fa502c86566680ac62bc28ec883a069bf7a2aa5e to before 2d17cf10179a7de6d8f0128168b84ad0b4a1863fAffected fa502c86566680ac62bc28ec883a069bf7a2aa5e to before 8762785f459be1cfe6fcf7285c123aad6a3703f0Affected
LinuxLinux	6.5Affected before 6.5Not affected 6.6.19 through 6.6.Not affected 6.7.7 through 6.7.Not affected 6.8 and laterNot affected

Product

Versions

LinuxLinux

7c71b831220edeab7ce603d818dc1708d9ea4137 to before 13b57b5cd591d5b22f9bbf047b2922967de411f3Affected
9c5662e95a8dcc232c3ef4deb21033badcd260f6 to before a6cafdb49a7bbf4a88367db209703eee6941e023Affected
fa502c86566680ac62bc28ec883a069bf7a2aa5e to before 9256ab9232e35a16af9c30fa4e522e6d1bd3605aAffected
fa502c86566680ac62bc28ec883a069bf7a2aa5e to before 2d17cf10179a7de6d8f0128168b84ad0b4a1863fAffected
fa502c86566680ac62bc28ec883a069bf7a2aa5e to before 8762785f459be1cfe6fcf7285c123aad6a3703f0Affected

LinuxLinux

6.5Affected
before 6.5Not affected
6.6.19 through 6.6.*Not affected
6.7.7 through 6.7.*Not affected
6.8 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.