CVE-2026-90061 (GCVE-0-2026-90061)
Vulnerability from cvelistv5
Published
2026-09-17 16:05
Modified
2026-10-30 12:33
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: skip double clone set expressions on element insert Both the dynset and newsetelem path clone the existing set expressions when setting set element expressions if no override expressions are provided. This results in a double clone, once to clone the template set expressions then another clone on the new element. Add a flag to annotate if userspace provides a override expression (ie. expression of the same type of the set but different configuration), otherwise borrow the existing expression from the set. Add conditionals to release expression iif they represent an override. Use this new override_exprs flag to dump the dynset expression override to userspace. This simplifies the existing logic and it also fixes a bug with the connlimit expression which results in a module refcount imbalance WARNING splat when resorting on the default set expressions.
References
Impacted products
Vendor Product Version
Linux Linux Version: 65038428b2c6c5be79d3f78a6b79c0cdc3a58a41
Version: 65038428b2c6c5be79d3f78a6b79c0cdc3a58a41
Version: 65038428b2c6c5be79d3f78a6b79c0cdc3a58a41
Version: 65038428b2c6c5be79d3f78a6b79c0cdc3a58a41
Version: 65038428b2c6c5be79d3f78a6b79c0cdc3a58a41
Version: 65038428b2c6c5be79d3f78a6b79c0cdc3a58a41
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/net/netfilter/nf_tables.h",
            "net/netfilter/nf_tables_api.c",
            "net/netfilter/nft_dynset.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "109bf28a90ac365ec4d25622c50959bb43b35ed4",
              "status": "affected",
              "version": "65038428b2c6c5be79d3f78a6b79c0cdc3a58a41",
              "versionType": "git"
            },
            {
              "lessThan": "9cbf6da967ec8c6e8278b70353b712980a12d848",
              "status": "affected",
              "version": "65038428b2c6c5be79d3f78a6b79c0cdc3a58a41",
              "versionType": "git"
            },
            {
              "lessThan": "04d1930072e694d9d03bfefdb7e1ebdc872a3d0c",
              "status": "affected",
              "version": "65038428b2c6c5be79d3f78a6b79c0cdc3a58a41",
              "versionType": "git"
            },
            {
              "lessThan": "c6b56b8d549a043b6c8ff616db8748263eae05ae",
              "status": "affected",
              "version": "65038428b2c6c5be79d3f78a6b79c0cdc3a58a41",
              "versionType": "git"
            },
            {
              "lessThan": "1e7fb6801d9cc826adcdb7fa0533c397730657f2",
              "status": "affected",
              "version": "65038428b2c6c5be79d3f78a6b79c0cdc3a58a41",
              "versionType": "git"
            },
            {
              "lessThan": "43559058d21e0493aa220ac167e0279334dea5f9",
              "status": "affected",
              "version": "65038428b2c6c5be79d3f78a6b79c0cdc3a58a41",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/net/netfilter/nf_tables.h",
            "net/netfilter/nf_tables_api.c",
            "net/netfilter/nft_dynset.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.7"
            },
            {
              "lessThan": "5.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.191",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.160",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.114",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.57",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.191",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.160",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.114",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.57",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.6",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: skip double clone set expressions on element insert\n\nBoth the dynset and newsetelem path clone the existing set expressions\nwhen setting set element expressions if no override expressions are\nprovided. This results in a double clone, once to clone the template set\nexpressions then another clone on the new element. Add a flag to\nannotate if userspace provides a override expression (ie. expression of\nthe same type of the set but different configuration), otherwise borrow\nthe existing expression from the set. Add conditionals to release\nexpression iif they represent an override. Use this new override_exprs\nflag to dump the dynset expression override to userspace.\n\nThis simplifies the existing logic and it also fixes a bug with the\nconnlimit expression which results in a module refcount imbalance\nWARNING splat when resorting on the default set expressions."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-30T12:33:59.233Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/109bf28a90ac365ec4d25622c50959bb43b35ed4"
        },
        {
          "url": "https://git.kernel.org/stable/c/9cbf6da967ec8c6e8278b70353b712980a12d848"
        },
        {
          "url": "https://git.kernel.org/stable/c/04d1930072e694d9d03bfefdb7e1ebdc872a3d0c"
        },
        {
          "url": "https://git.kernel.org/stable/c/c6b56b8d549a043b6c8ff616db8748263eae05ae"
        },
        {
          "url": "https://git.kernel.org/stable/c/1e7fb6801d9cc826adcdb7fa0533c397730657f2"
        },
        {
          "url": "https://git.kernel.org/stable/c/43559058d21e0493aa220ac167e0279334dea5f9"
        }
      ],
      "title": "netfilter: nf_tables: skip double clone set expressions on element insert",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-90061",
    "datePublished": "2026-09-17T16:05:45.182Z",
    "dateReserved": "2026-09-11T19:38:34.784Z",
    "dateUpdated": "2026-10-30T12:33:59.233Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.