Tuan Do
f8dca15a1b
netfilter: nft_ct: fix use-after-free in timeout object destroy
...
nft_ct_timeout_obj_destroy() frees the timeout object with kfree()
immediately after nf_ct_untimeout(), without waiting for an RCU grace
period. Concurrent packet processing on other CPUs may still hold
RCU-protected references to the timeout object obtained via
rcu_dereference() in nf_ct_timeout_data().
Add an rcu_head to struct nf_ct_timeout and use kfree_rcu() to defer
freeing until after an RCU grace period, matching the approach already
used in nfnetlink_cttimeout.c.
KASAN report:
BUG: KASAN: slab-use-after-free in nf_conntrack_tcp_packet+0x1381/0x29d0
Read of size 4 at addr ffff8881035fe19c by task exploit/80
Call Trace:
nf_conntrack_tcp_packet+0x1381/0x29d0
nf_conntrack_in+0x612/0x8b0
nf_hook_slow+0x70/0x100
__ip_local_out+0x1b2/0x210
tcp_sendmsg_locked+0x722/0x1580
__sys_sendto+0x2d8/0x320
Allocated by task 75:
nft_ct_timeout_obj_init+0xf6/0x290
nft_obj_init+0x107/0x1b0
nf_tables_newobj+0x680/0x9c0
nfnetlink_rcv_batch+0xc29/0xe00
Freed by task 26:
nft_obj_destroy+0x3f/0xa0
nf_tables_trans_destroy_work+0x51c/0x5c0
process_one_work+0x2c4/0x5a0
Fixes: 7e0b2b57f0 ("netfilter: nft_ct: add ct timeout support")
Cc: stable@vger.kernel.org
Signed-off-by: Tuan Do <tuan@calif.io >
Signed-off-by: Florian Westphal <fw@strlen.de >
2026-04-08 13:34:16 +02:00
..
2025-11-03 16:49:53 +09:00
2026-03-19 14:44:25 -04:00
2024-10-08 15:33:49 -07:00
2026-02-21 01:02:28 -08:00
2026-03-05 08:02:05 -08:00
2026-02-12 17:05:20 -08:00
2026-04-08 13:34:16 +02:00
2026-03-26 18:32:14 -07:00
2026-01-28 19:32:26 -08:00
2026-03-10 19:03:34 -07:00
2024-10-24 16:03:40 +02:00
2026-01-12 19:29:11 -08:00
2025-11-07 18:53:57 -08:00
2025-11-14 18:00:34 -08:00
2026-03-05 07:54:08 -08:00
2026-02-27 19:06:21 -08:00
2026-02-17 17:12:06 -08:00
2025-04-24 17:03:45 -07:00
2025-07-08 18:05:25 -07:00
2026-02-26 11:10:03 +01:00
2025-07-02 14:22:02 -07:00
2022-07-22 12:53:22 +01:00
2023-03-21 21:32:18 -07:00
2026-02-18 10:45:36 -08:00
2022-08-09 22:14:02 -07:00
2021-12-13 12:34:09 +00:00
2025-09-09 10:56:02 +02:00
2024-08-26 09:37:22 -07:00
2025-09-09 10:56:02 +02:00
2026-03-03 10:47:37 +01:00
2021-03-26 17:43:55 +01:00
2025-02-27 14:03:14 +01:00
2024-10-02 17:23:23 -04:00
2026-02-05 11:58:39 +01:00
2022-11-16 11:31:47 +02:00
2026-02-02 10:11:07 +01:00
2024-03-06 21:01:26 +01:00
2025-05-30 19:53:51 -07:00
2024-10-02 17:23:23 -04:00
2025-09-14 11:55:04 -07:00
2026-03-24 20:57:57 -07:00
2022-07-22 12:53:22 +01:00
2023-07-14 20:39:29 -07:00
2022-07-24 18:39:17 -06:00
2023-07-27 17:17:32 -07:00
2022-07-22 12:53:22 +01:00
2023-01-20 09:33:22 +00:00
2025-11-20 19:01:22 -08:00
2026-01-13 10:12:11 +01:00
2025-02-11 11:58:17 +01:00
2023-10-24 13:08:14 -07:00
2026-02-11 11:27:57 +01:00
2024-05-08 10:35:09 +01:00
2024-08-26 09:37:23 -07:00
2025-09-14 14:28:12 -07:00
2024-05-29 17:34:49 -07:00
2026-02-02 17:49:29 -08:00
2024-11-13 18:49:50 -08:00
2024-08-26 09:37:23 -07:00
2022-07-22 12:53:22 +01:00
2024-04-01 21:27:08 -07:00
2022-07-22 12:53:22 +01:00
2021-12-06 16:06:02 -08:00
2024-10-11 15:35:05 -07:00
2025-04-15 17:54:56 -07:00
2022-07-28 22:21:54 -07:00
2024-07-15 09:14:39 -07:00
2026-02-10 15:30:11 +01:00
2025-08-26 17:34:31 -07:00
2023-04-12 16:40:39 -07:00
2026-02-21 17:09:51 -08:00
2023-08-08 15:58:23 -07:00
2022-07-22 12:53:22 +01:00
2021-10-18 12:54:41 +01:00
2025-09-03 15:16:49 -07:00
2022-10-31 10:43:04 +00:00
2024-04-01 10:49:28 +01:00
2026-01-21 19:28:32 -08:00
2023-06-10 00:11:41 -07:00
2024-05-07 01:35:55 +02:00
2022-07-22 12:53:22 +01:00
2023-07-28 14:07:59 -07:00
2026-01-13 10:12:11 +01:00
2024-08-26 09:37:23 -07:00
2025-09-11 12:22:38 +02:00
2024-05-08 10:35:09 +01:00
2025-10-30 08:38:51 +01:00
2023-11-20 11:43:03 +01:00
2024-02-26 18:40:34 -08:00
2026-02-10 20:57:50 -08:00
2026-02-27 17:16:59 -08:00
2025-11-04 19:10:33 -08:00
2026-02-19 14:02:19 -08:00
2025-08-26 17:34:31 -07:00
2026-02-03 15:13:24 +01:00
2025-12-10 01:15:27 -08:00
2026-03-23 18:46:45 -07:00
2026-02-02 17:49:30 -08:00
2025-09-23 10:12:15 +02:00
2024-12-17 19:37:00 -08:00
2026-02-13 12:24:05 -08:00
2021-11-16 13:16:54 +00:00
2026-03-23 16:59:31 -07:00
2026-02-02 17:49:29 -08:00
2026-03-12 16:03:41 +01:00
2026-03-03 17:20:37 -08:00
2026-04-03 15:52:10 -07:00
2025-08-13 08:34:33 +02:00
2026-02-27 17:16:59 -08:00
2025-03-21 17:36:49 +08:00
2022-07-22 12:53:22 +01:00
2025-12-10 01:15:27 -08:00
2025-11-04 19:10:33 -08:00
2026-02-17 16:45:29 -08:00
2024-10-09 08:53:01 +02:00
2025-08-13 18:18:33 -07:00
2026-02-02 17:09:11 -08:00
2024-12-06 17:43:08 -08:00
2023-08-04 15:33:17 -07:00
2023-08-04 15:33:17 -07:00
2024-07-15 08:51:01 -07:00
2023-07-20 10:46:28 +02:00
2021-10-13 09:40:46 -07:00
2024-08-26 09:37:23 -07:00
2022-07-22 12:53:22 +01:00
2022-07-22 12:53:22 +01:00
2024-07-15 08:51:19 -07:00
2021-11-07 19:25:29 +00:00
2025-07-02 14:32:30 -07:00
2026-03-18 09:09:58 +01:00
2024-10-02 17:23:23 -04:00
2025-01-20 12:20:42 +00:00
2025-07-15 12:08:39 +02:00
2024-11-09 09:04:54 -08:00
2021-03-26 15:14:56 -07:00
2022-07-22 12:53:22 +01:00
2020-05-29 21:20:20 -07:00
2025-04-15 08:21:46 -07:00
2022-11-18 12:14:55 +00:00
2022-07-22 12:53:22 +01:00
2025-07-10 15:27:32 -07:00
2024-11-09 13:22:57 -08:00
2025-10-24 17:57:20 -07:00
2024-11-30 13:41:50 -08:00
2026-02-06 20:01:31 -08:00
2024-10-10 08:30:22 -07:00
2021-12-10 06:38:26 -08:00
2025-05-22 09:42:41 -07:00
2025-03-12 13:32:35 -07:00
2026-01-23 11:49:02 -08:00
2026-01-20 18:06:01 -08:00
2022-07-22 12:53:22 +01:00
2023-11-20 10:15:16 -08:00
2024-11-21 08:28:08 -08:00
2025-07-02 15:39:04 -07:00
2026-01-25 13:18:53 -08:00
2022-07-22 12:53:22 +01:00
2025-04-24 09:29:56 +02:00
2025-10-20 17:13:40 -07:00
2023-07-14 20:39:29 -07:00
2025-06-13 18:17:08 -07:00
2023-07-14 20:39:30 -07:00
2025-11-04 19:10:33 -08:00
2025-11-24 18:53:14 -08:00
2026-02-05 09:32:45 -08:00
2022-07-22 12:53:22 +01:00
2025-10-16 12:04:47 -07:00
2024-03-07 21:12:43 -08:00
2024-07-11 18:11:31 -07:00
2022-07-22 12:53:22 +01:00
2025-09-18 12:32:06 +02:00
2025-09-14 11:35:17 -07:00
2023-03-17 08:56:37 +00:00
2024-08-26 09:37:23 -07:00
2024-08-26 09:37:23 -07:00
2026-02-05 09:23:06 -08:00
2025-08-27 07:43:08 -07:00
2025-08-29 19:36:32 -07:00
2023-06-19 11:32:58 -07:00
2025-09-03 15:08:20 -07:00
2023-07-14 20:39:30 -07:00
2025-04-11 18:58:10 -07:00
2025-02-21 15:28:03 -08:00
2026-03-17 12:09:16 +01:00
2026-01-13 11:54:29 +01:00
2025-07-04 09:32:35 +02:00
2026-03-04 17:44:35 -08:00
2025-08-26 18:11:29 -07:00
2024-06-24 16:41:23 -07:00
2024-05-30 18:29:38 -07:00
2025-11-06 13:38:11 +01:00
2025-11-10 11:19:41 -08:00
2025-09-08 18:06:21 -07:00
2024-08-02 17:16:59 -07:00
2026-02-24 11:27:29 +01:00
2023-10-04 11:49:20 -07:00
2022-07-22 12:53:22 +01:00
2025-05-05 16:48:12 -07:00
2024-02-16 09:36:37 +00:00
2024-02-14 10:49:37 +01:00
2025-09-11 19:05:56 -07:00
2026-02-03 15:13:25 +01:00
2023-12-04 14:45:26 -08:00
2026-03-04 17:44:35 -08:00
2025-07-11 11:00:57 -07:00
2025-08-25 17:53:35 -07:00
2023-07-28 14:07:59 -07:00
2025-10-31 06:46:03 -07:00
2023-08-01 15:06:27 -07:00
2022-12-12 15:04:39 -08:00
2022-07-22 12:53:22 +01:00
2026-03-18 18:00:07 -07:00
2026-02-21 20:03:00 -08:00
2023-09-14 16:16:36 +02:00
2025-11-04 19:10:32 -08:00
2025-06-17 18:18:46 -07:00
2025-07-14 17:19:13 -07:00
2022-07-22 12:53:22 +01:00
2026-04-06 18:43:51 -07:00
2026-04-06 18:43:51 -07:00
2025-09-24 10:22:37 -07:00
2026-02-10 20:21:48 -08:00
2026-01-15 10:07:45 +01:00