{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-26669", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-02-19T14:20:24.150Z", "datePublished": "2024-04-02T06:43:30.378Z", "dateUpdated": "2025-05-04T08:53:33.748Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2025-05-04T08:53:33.748Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: flower: Fix chain template offload\n\nWhen a qdisc is deleted from a net device the stack instructs the\nunderlying driver to remove its flow offload callback from the\nassociated filter block using the 'FLOW_BLOCK_UNBIND' command. The stack\nthen continues to replay the removal of the filters in the block for\nthis driver by iterating over the chains in the block and invoking the\n'reoffload' operation of the classifier being used. In turn, the\nclassifier in its 'reoffload' operation prepares and emits a\n'FLOW_CLS_DESTROY' command for each filter.\n\nHowever, the stack does not do the same for chain templates and the\nunderlying driver never receives a 'FLOW_CLS_TMPLT_DESTROY' command when\na qdisc is deleted. This results in a memory leak [1] which can be\nreproduced using [2].\n\nFix by introducing a 'tmplt_reoffload' operation and have the stack\ninvoke it with the appropriate arguments as part of the replay.\nImplement the operation in the sole classifier that supports chain\ntemplates (flower) by emitting the 'FLOW_CLS_TMPLT_{CREATE,DESTROY}'\ncommand based on whether a flow offload callback is being bound to a\nfilter block or being unbound from one.\n\nAs far as I can tell, the issue happens since cited commit which\nreordered tcf_block_offload_unbind() before tcf_block_flush_all_chains()\nin __tcf_block_put(). The order cannot be reversed as the filter block\nis expected to be freed after flushing all the chains.\n\n[1]\nunreferenced object 0xffff888107e28800 (size 2048):\n comm \"tc\", pid 1079, jiffies 4294958525 (age 3074.287s)\n hex dump (first 32 bytes):\n b1 a6 7c 11 81 88 ff ff e0 5b b3 10 81 88 ff ff ..|......[......\n 01 00 00 00 00 00 00 00 e0 aa b0 84 ff ff ff ff ................\n backtrace:\n [<ffffffff81c06a68>] __kmem_cache_alloc_node+0x1e8/0x320\n [<ffffffff81ab374e>] __kmalloc+0x4e/0x90\n [<ffffffff832aec6d>] mlxsw_sp_acl_ruleset_get+0x34d/0x7a0\n [<ffffffff832bc195>] mlxsw_sp_flower_tmplt_create+0x145/0x180\n [<ffffffff832b2e1a>] mlxsw_sp_flow_block_cb+0x1ea/0x280\n [<ffffffff83a10613>] tc_setup_cb_call+0x183/0x340\n [<ffffffff83a9f85a>] fl_tmplt_create+0x3da/0x4c0\n [<ffffffff83a22435>] tc_ctl_chain+0xa15/0x1170\n [<ffffffff838a863c>] rtnetlink_rcv_msg+0x3cc/0xed0\n [<ffffffff83ac87f0>] netlink_rcv_skb+0x170/0x440\n [<ffffffff83ac6270>] netlink_unicast+0x540/0x820\n [<ffffffff83ac6e28>] netlink_sendmsg+0x8d8/0xda0\n [<ffffffff83793def>] ____sys_sendmsg+0x30f/0xa80\n [<ffffffff8379d29a>] ___sys_sendmsg+0x13a/0x1e0\n [<ffffffff8379d50c>] __sys_sendmsg+0x11c/0x1f0\n [<ffffffff843b9ce0>] do_syscall_64+0x40/0xe0\nunreferenced object 0xffff88816d2c0400 (size 1024):\n comm \"tc\", pid 1079, jiffies 4294958525 (age 3074.287s)\n hex dump (first 32 bytes):\n 40 00 00 00 00 00 00 00 57 f6 38 be 00 00 00 00 @.......W.8.....\n 10 04 2c 6d 81 88 ff ff 10 04 2c 6d 81 88 ff ff ..,m......,m....\n backtrace:\n [<ffffffff81c06a68>] __kmem_cache_alloc_node+0x1e8/0x320\n [<ffffffff81ab36c1>] __kmalloc_node+0x51/0x90\n [<ffffffff81a8ed96>] kvmalloc_node+0xa6/0x1f0\n [<ffffffff82827d03>] bucket_table_alloc.isra.0+0x83/0x460\n [<ffffffff82828d2b>] rhashtable_init+0x43b/0x7c0\n [<ffffffff832aed48>] mlxsw_sp_acl_ruleset_get+0x428/0x7a0\n [<ffffffff832bc195>] mlxsw_sp_flower_tmplt_create+0x145/0x180\n [<ffffffff832b2e1a>] mlxsw_sp_flow_block_cb+0x1ea/0x280\n [<ffffffff83a10613>] tc_setup_cb_call+0x183/0x340\n [<ffffffff83a9f85a>] fl_tmplt_create+0x3da/0x4c0\n [<ffffffff83a22435>] tc_ctl_chain+0xa15/0x1170\n [<ffffffff838a863c>] rtnetlink_rcv_msg+0x3cc/0xed0\n [<ffffffff83ac87f0>] netlink_rcv_skb+0x170/0x440\n [<ffffffff83ac6270>] netlink_unicast+0x540/0x820\n [<ffffffff83ac6e28>] netlink_sendmsg+0x8d8/0xda0\n [<ffffffff83793def>] ____sys_sendmsg+0x30f/0xa80\n\n[2]\n # tc qdisc add dev swp1 clsact\n # tc chain add dev swp1 ingress proto ip chain 1 flower dst_ip 0.0.0.0/32\n # tc qdisc del dev\n---truncated---"}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["include/net/sch_generic.h", "net/sched/cls_api.c", "net/sched/cls_flower.c"], "versions": [{"version": "bbf73830cd48cff1599811d4f69c7cfd49c7b869", "lessThan": "9ed46144cff3598a5cf79955630e795ff9af5b97", "status": "affected", "versionType": "git"}, {"version": "bbf73830cd48cff1599811d4f69c7cfd49c7b869", "lessThan": "c04709b2cc99ae31c346f79f0211752d7b74df01", "status": "affected", "versionType": "git"}, {"version": "bbf73830cd48cff1599811d4f69c7cfd49c7b869", "lessThan": "32f2a0afa95fae0d1ceec2ff06e0e816939964b8", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["include/net/sch_generic.h", "net/sched/cls_api.c", "net/sched/cls_flower.c"], "versions": [{"version": "5.1", "status": "affected"}, {"version": "0", "lessThan": "5.1", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.15", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.7.3", "lessThanOrEqual": "6.7.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.8", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.1", "versionEndExcluding": "6.6.15"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.1", "versionEndExcluding": "6.7.3"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.1", "versionEndExcluding": "6.8"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/9ed46144cff3598a5cf79955630e795ff9af5b97"}, {"url": "https://git.kernel.org/stable/c/c04709b2cc99ae31c346f79f0211752d7b74df01"}, {"url": "https://git.kernel.org/stable/c/32f2a0afa95fae0d1ceec2ff06e0e816939964b8"}], "title": "net/sched: flower: Fix chain template offload", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-04-02T18:36:26.875588Z", "id": "CVE-2024-26669", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-04T17:38:55.453Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:14:12.714Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/9ed46144cff3598a5cf79955630e795ff9af5b97", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/c04709b2cc99ae31c346f79f0211752d7b74df01", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/32f2a0afa95fae0d1ceec2ff06e0e816939964b8", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/9ed46144cff3598a5cf79955630e795ff9af5b97", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/c04709b2cc99ae31c346f79f0211752d7b74df01", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/32f2a0afa95fae0d1ceec2ff06e0e816939964b8", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:14:12.714Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-26669", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-04-02T18:36:26.875588Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-23T19:01:21.323Z"}}], "cna": {"title": "net/sched: flower: Fix chain template offload", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "bbf73830cd48cff1599811d4f69c7cfd49c7b869", "lessThan": "9ed46144cff3598a5cf79955630e795ff9af5b97", "versionType": "git"}, {"status": "affected", "version": "bbf73830cd48cff1599811d4f69c7cfd49c7b869", "lessThan": "c04709b2cc99ae31c346f79f0211752d7b74df01", "versionType": "git"}, {"status": "affected", "version": "bbf73830cd48cff1599811d4f69c7cfd49c7b869", "lessThan": "32f2a0afa95fae0d1ceec2ff06e0e816939964b8", "versionType": "git"}], "programFiles": ["include/net/sch_generic.h", "net/sched/cls_api.c", "net/sched/cls_flower.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.1"}, {"status": "unaffected", "version": "0", "lessThan": "5.1", "versionType": "semver"}, {"status": "unaffected", "version": "6.6.15", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.7.3", "versionType": "semver", "lessThanOrEqual": "6.7.*"}, {"status": "unaffected", "version": "6.8", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["include/net/sch_generic.h", "net/sched/cls_api.c", "net/sched/cls_flower.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/9ed46144cff3598a5cf79955630e795ff9af5b97"}, {"url": "https://git.kernel.org/stable/c/c04709b2cc99ae31c346f79f0211752d7b74df01"}, {"url": "https://git.kernel.org/stable/c/32f2a0afa95fae0d1ceec2ff06e0e816939964b8"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: flower: Fix chain template offload\n\nWhen a qdisc is deleted from a net device the stack instructs the\nunderlying driver to remove its flow offload callback from the\nassociated filter block using the 'FLOW_BLOCK_UNBIND' command. The stack\nthen continues to replay the removal of the filters in the block for\nthis driver by iterating over the chains in the block and invoking the\n'reoffload' operation of the classifier being used. In turn, the\nclassifier in its 'reoffload' operation prepares and emits a\n'FLOW_CLS_DESTROY' command for each filter.\n\nHowever, the stack does not do the same for chain templates and the\nunderlying driver never receives a 'FLOW_CLS_TMPLT_DESTROY' command when\na qdisc is deleted. This results in a memory leak [1] which can be\nreproduced using [2].\n\nFix by introducing a 'tmplt_reoffload' operation and have the stack\ninvoke it with the appropriate arguments as part of the replay.\nImplement the operation in the sole classifier that supports chain\ntemplates (flower) by emitting the 'FLOW_CLS_TMPLT_{CREATE,DESTROY}'\ncommand based on whether a flow offload callback is being bound to a\nfilter block or being unbound from one.\n\nAs far as I can tell, the issue happens since cited commit which\nreordered tcf_block_offload_unbind() before tcf_block_flush_all_chains()\nin __tcf_block_put(). The order cannot be reversed as the filter block\nis expected to be freed after flushing all the chains.\n\n[1]\nunreferenced object 0xffff888107e28800 (size 2048):\n comm \"tc\", pid 1079, jiffies 4294958525 (age 3074.287s)\n hex dump (first 32 bytes):\n b1 a6 7c 11 81 88 ff ff e0 5b b3 10 81 88 ff ff ..|......[......\n 01 00 00 00 00 00 00 00 e0 aa b0 84 ff ff ff ff ................\n backtrace:\n [<ffffffff81c06a68>] __kmem_cache_alloc_node+0x1e8/0x320\n [<ffffffff81ab374e>] __kmalloc+0x4e/0x90\n [<ffffffff832aec6d>] mlxsw_sp_acl_ruleset_get+0x34d/0x7a0\n [<ffffffff832bc195>] mlxsw_sp_flower_tmplt_create+0x145/0x180\n [<ffffffff832b2e1a>] mlxsw_sp_flow_block_cb+0x1ea/0x280\n [<ffffffff83a10613>] tc_setup_cb_call+0x183/0x340\n [<ffffffff83a9f85a>] fl_tmplt_create+0x3da/0x4c0\n [<ffffffff83a22435>] tc_ctl_chain+0xa15/0x1170\n [<ffffffff838a863c>] rtnetlink_rcv_msg+0x3cc/0xed0\n [<ffffffff83ac87f0>] netlink_rcv_skb+0x170/0x440\n [<ffffffff83ac6270>] netlink_unicast+0x540/0x820\n [<ffffffff83ac6e28>] netlink_sendmsg+0x8d8/0xda0\n [<ffffffff83793def>] ____sys_sendmsg+0x30f/0xa80\n [<ffffffff8379d29a>] ___sys_sendmsg+0x13a/0x1e0\n [<ffffffff8379d50c>] __sys_sendmsg+0x11c/0x1f0\n [<ffffffff843b9ce0>] do_syscall_64+0x40/0xe0\nunreferenced object 0xffff88816d2c0400 (size 1024):\n comm \"tc\", pid 1079, jiffies 4294958525 (age 3074.287s)\n hex dump (first 32 bytes):\n 40 00 00 00 00 00 00 00 57 f6 38 be 00 00 00 00 @.......W.8.....\n 10 04 2c 6d 81 88 ff ff 10 04 2c 6d 81 88 ff ff ..,m......,m....\n backtrace:\n [<ffffffff81c06a68>] __kmem_cache_alloc_node+0x1e8/0x320\n [<ffffffff81ab36c1>] __kmalloc_node+0x51/0x90\n [<ffffffff81a8ed96>] kvmalloc_node+0xa6/0x1f0\n [<ffffffff82827d03>] bucket_table_alloc.isra.0+0x83/0x460\n [<ffffffff82828d2b>] rhashtable_init+0x43b/0x7c0\n [<ffffffff832aed48>] mlxsw_sp_acl_ruleset_get+0x428/0x7a0\n [<ffffffff832bc195>] mlxsw_sp_flower_tmplt_create+0x145/0x180\n [<ffffffff832b2e1a>] mlxsw_sp_flow_block_cb+0x1ea/0x280\n [<ffffffff83a10613>] tc_setup_cb_call+0x183/0x340\n [<ffffffff83a9f85a>] fl_tmplt_create+0x3da/0x4c0\n [<ffffffff83a22435>] tc_ctl_chain+0xa15/0x1170\n [<ffffffff838a863c>] rtnetlink_rcv_msg+0x3cc/0xed0\n [<ffffffff83ac87f0>] netlink_rcv_skb+0x170/0x440\n [<ffffffff83ac6270>] netlink_unicast+0x540/0x820\n [<ffffffff83ac6e28>] netlink_sendmsg+0x8d8/0xda0\n [<ffffffff83793def>] ____sys_sendmsg+0x30f/0xa80\n\n[2]\n # tc qdisc add dev swp1 clsact\n # tc chain add dev swp1 ingress proto ip chain 1 flower dst_ip 0.0.0.0/32\n # tc qdisc del dev\n---truncated---"}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.15", "versionStartIncluding": "5.1"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.7.3", "versionStartIncluding": "5.1"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.8", "versionStartIncluding": "5.1"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2025-05-04T08:53:33.748Z"}}}, "cveMetadata": {"cveId": "CVE-2024-26669", "state": "PUBLISHED", "dateUpdated": "2025-05-04T08:53:33.748Z", "dateReserved": "2024-02-19T14:20:24.150Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-04-02T06:43:30.378Z", "assignerShortName": "Linux"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "13124899-DFE8-443A-B42E-08D902793E4B", "versionEndExcluding": "6.6.15", "versionStartIncluding": "5.1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "58FD5308-148A-40D3-B36A-0CA6B434A8BF", "versionEndExcluding": "6.7.3", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.8:rc1:*:*:*:*:*:*", "matchCriteriaId": "B9F4EA73-0894-400F-A490-3A397AB7A517", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: flower: Fix chain template offload\n\nWhen a qdisc is deleted from a net device the stack instructs the\nunderlying driver to remove its flow offload callback from the\nassociated filter block using the 'FLOW_BLOCK_UNBIND' command. The stack\nthen continues to replay the removal of the filters in the block for\nthis driver by iterating over the chains in the block and invoking the\n'reoffload' operation of the classifier being used. In turn, the\nclassifier in its 'reoffload' operation prepares and emits a\n'FLOW_CLS_DESTROY' command for each filter.\n\nHowever, the stack does not do the same for chain templates and the\nunderlying driver never receives a 'FLOW_CLS_TMPLT_DESTROY' command when\na qdisc is deleted. This results in a memory leak [1] which can be\nreproduced using [2].\n\nFix by introducing a 'tmplt_reoffload' operation and have the stack\ninvoke it with the appropriate arguments as part of the replay.\nImplement the operation in the sole classifier that supports chain\ntemplates (flower) by emitting the 'FLOW_CLS_TMPLT_{CREATE,DESTROY}'\ncommand based on whether a flow offload callback is being bound to a\nfilter block or being unbound from one.\n\nAs far as I can tell, the issue happens since cited commit which\nreordered tcf_block_offload_unbind() before tcf_block_flush_all_chains()\nin __tcf_block_put(). The order cannot be reversed as the filter block\nis expected to be freed after flushing all the chains.\n\n[1]\nunreferenced object 0xffff888107e28800 (size 2048):\n comm \"tc\", pid 1079, jiffies 4294958525 (age 3074.287s)\n hex dump (first 32 bytes):\n b1 a6 7c 11 81 88 ff ff e0 5b b3 10 81 88 ff ff ..|......[......\n 01 00 00 00 00 00 00 00 e0 aa b0 84 ff ff ff ff ................\n backtrace:\n [<ffffffff81c06a68>] __kmem_cache_alloc_node+0x1e8/0x320\n [<ffffffff81ab374e>] __kmalloc+0x4e/0x90\n [<ffffffff832aec6d>] mlxsw_sp_acl_ruleset_get+0x34d/0x7a0\n [<ffffffff832bc195>] mlxsw_sp_flower_tmplt_create+0x145/0x180\n [<ffffffff832b2e1a>] mlxsw_sp_flow_block_cb+0x1ea/0x280\n [<ffffffff83a10613>] tc_setup_cb_call+0x183/0x340\n [<ffffffff83a9f85a>] fl_tmplt_create+0x3da/0x4c0\n [<ffffffff83a22435>] tc_ctl_chain+0xa15/0x1170\n [<ffffffff838a863c>] rtnetlink_rcv_msg+0x3cc/0xed0\n [<ffffffff83ac87f0>] netlink_rcv_skb+0x170/0x440\n [<ffffffff83ac6270>] netlink_unicast+0x540/0x820\n [<ffffffff83ac6e28>] netlink_sendmsg+0x8d8/0xda0\n [<ffffffff83793def>] ____sys_sendmsg+0x30f/0xa80\n [<ffffffff8379d29a>] ___sys_sendmsg+0x13a/0x1e0\n [<ffffffff8379d50c>] __sys_sendmsg+0x11c/0x1f0\n [<ffffffff843b9ce0>] do_syscall_64+0x40/0xe0\nunreferenced object 0xffff88816d2c0400 (size 1024):\n comm \"tc\", pid 1079, jiffies 4294958525 (age 3074.287s)\n hex dump (first 32 bytes):\n 40 00 00 00 00 00 00 00 57 f6 38 be 00 00 00 00 @.......W.8.....\n 10 04 2c 6d 81 88 ff ff 10 04 2c 6d 81 88 ff ff ..,m......,m....\n backtrace:\n [<ffffffff81c06a68>] __kmem_cache_alloc_node+0x1e8/0x320\n [<ffffffff81ab36c1>] __kmalloc_node+0x51/0x90\n [<ffffffff81a8ed96>] kvmalloc_node+0xa6/0x1f0\n [<ffffffff82827d03>] bucket_table_alloc.isra.0+0x83/0x460\n [<ffffffff82828d2b>] rhashtable_init+0x43b/0x7c0\n [<ffffffff832aed48>] mlxsw_sp_acl_ruleset_get+0x428/0x7a0\n [<ffffffff832bc195>] mlxsw_sp_flower_tmplt_create+0x145/0x180\n [<ffffffff832b2e1a>] mlxsw_sp_flow_block_cb+0x1ea/0x280\n [<ffffffff83a10613>] tc_setup_cb_call+0x183/0x340\n [<ffffffff83a9f85a>] fl_tmplt_create+0x3da/0x4c0\n [<ffffffff83a22435>] tc_ctl_chain+0xa15/0x1170\n [<ffffffff838a863c>] rtnetlink_rcv_msg+0x3cc/0xed0\n [<ffffffff83ac87f0>] netlink_rcv_skb+0x170/0x440\n [<ffffffff83ac6270>] netlink_unicast+0x540/0x820\n [<ffffffff83ac6e28>] netlink_sendmsg+0x8d8/0xda0\n [<ffffffff83793def>] ____sys_sendmsg+0x30f/0xa80\n\n[2]\n # tc qdisc add dev swp1 clsact\n # tc chain add dev swp1 ingress proto ip chain 1 flower dst_ip 0.0.0.0/32\n # tc qdisc del dev\n---truncated---"}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net/sched: flower: descarga de plantilla de cadena fija Cuando se elimina una qdisc de un dispositivo de red, la pila indica al controlador subyacente que elimine su devoluci\u00f3n de llamada de descarga de flujo del bloque de filtro asociado mediante el comando Comando 'FLOW_BLOCK_UNBIND'. Luego, la pila contin\u00faa reproduciendo la eliminaci\u00f3n de los filtros en el bloque para este controlador iterando sobre las cadenas en el bloque e invocando la operaci\u00f3n de \"redescarga\" del clasificador que se est\u00e1 utilizando. A su vez, el clasificador en su operaci\u00f3n de 'redescarga' prepara y emite un comando 'FLOW_CLS_DESTROY' para cada filtro. Sin embargo, la pila no hace lo mismo con las plantillas de cadena y el controlador subyacente nunca recibe un comando 'FLOW_CLS_TMPLT_DESTROY' cuando se elimina una qdisc. Esto da como resultado una p\u00e9rdida de memoria [1] que se puede reproducir usando [2]. Para solucionarlo, introduzca una operaci\u00f3n 'tmplt_reoffload' y haga que la pila la invoque con los argumentos apropiados como parte de la reproducci\u00f3n. Implemente la operaci\u00f3n en el \u00fanico clasificador que admite plantillas de cadena (flor) emitiendo el comando 'FLOW_CLS_TMPLT_{CREATE,DESTROY}' en funci\u00f3n de si una devoluci\u00f3n de llamada de descarga de flujo est\u00e1 vinculada a un bloque de filtro o no est\u00e1 vinculada a uno. Por lo que puedo decir, el problema ocurre desde el commit que reorden\u00f3 tcf_block_offload_unbind() antes de tcf_block_flush_all_chains() en __tcf_block_put(). El orden no se puede invertir ya que se espera que el bloque del filtro se libere despu\u00e9s de lavar todas las cadenas. [1] objeto sin referencia 0xffff888107e28800 (tama\u00f1o 2048): comm \"tc\", pid 1079, jiffies 4294958525 (edad 3074.287s) volcado hexadecimal (primeros 32 bytes): b1 a6 7c 11 81 88 ff ff e0 5b b3 10 81 88 ff f ..|......[...... 01 00 00 00 00 00 00 00 e0 aa b0 84 ff ff ff ff ................ retroceso: [] __kmem_cache_alloc_node+0x1e8/0x320 [] __kmalloc+0x4e/0x90 [] mlxsw_sp_acl_ruleset_get+0x34d/0x7a0 [] mlxsw_sp_flower_tmplt_create+0x145/0x180 [] mlxsw_sp_flow_block_cb+0x1ea/0x280 [] tc_setup_cb_call+0x183/0x340 [] fl_tmplt_create+0x3da/0x4c0 [] tc_ctl_chain+0xa15/0x1170 [] rtnetlink_rcv_msg+0x3cc/0xed0 [] netlink_rcv_skb+0x170/0x440 [] netlink_unicast+0x540/0x820 [] netlink_sendmsg+0x8d8/0xda0 [] ____sys_sendmsg+0x30f/0xa80 [] ___sys_ enviarmsg+0x13a/0x1e0 [] __sys_sendmsg+0x11c/0x1f0 [] do_syscall_64+0x40/0xe0 objeto sin referencia 0xffff88816d2c0400 (tama\u00f1o 1024): comm \"tc\", pid 1079, santiam\u00e9n 4294958525 (edad 3074.287s) volcado hexadecimal (primeros 32 bytes): 40 00 00 00 00 00 00 00 57 f6 38 be 00 00 00 00 @.......W.8..... 10 04 2c 6d 81 88 ff ff 10 04 2c 6d 81 88 ff ff ..,m......, m.... retroceso: [] __kmem_cache_alloc_node+0x1e8/0x320 [] __kmalloc_node+0x51/0x90 [] kvmalloc_node+0xa6/0x1f0 [] bucket_table_alloc.isra.0+0x83/ 0x460 [] rhashtable_init+0x43b/0x7c0 [] mlxsw_sp_acl_ruleset_get+0x428/0x7a0 [] mlxsw_sp_flower_tmplt_create+0x145/0x180 [] mlxsw_sp_flow_block_cb+0x1ea/0x280 [] tc_setup_cb_call+0x183/ 0x340 [] fl_tmplt_create+0x3da/0x4c0 [] tc_ctl_chain+0xa15/0x1170 [] rtnetlink_rcv_msg+0x3cc/0xed0 [] netlink_rcv_skb+0x170/0x440 [] netlink_unicast+0x540/ 0x820 [] netlink_sendmsg+0x8d8/0xda0 [] ____sys_sendmsg+0x30f/0xa80 [2] # ---truncado---"}], "id": "CVE-2024-26669", "lastModified": "2025-03-17T15:04:10.660", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2024-04-02T07:15:43.697", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/32f2a0afa95fae0d1ceec2ff06e0e816939964b8"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/9ed46144cff3598a5cf79955630e795ff9af5b97"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/c04709b2cc99ae31c346f79f0211752d7b74df01"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/32f2a0afa95fae0d1ceec2ff06e0e816939964b8"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/9ed46144cff3598a5cf79955630e795ff9af5b97"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/c04709b2cc99ae31c346f79f0211752d7b74df01"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"affected_release": [{"advisory": "RHSA-2024:5102", "cpe": "cpe:/a:redhat:enterprise_linux:8::nfv", "package": "kernel-rt-0:4.18.0-553.16.1.rt7.357.el8_10", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2024-08-08T00:00:00Z"}, {"advisory": "RHSA-2024:5101", "cpe": "cpe:/o:redhat:enterprise_linux:8", "package": "kernel-0:4.18.0-553.16.1.el8_10", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2024-08-08T00:00:00Z"}, {"advisory": "RHSA-2024:9315", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "kernel-0:5.14.0-503.11.1.el9_5", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2024-11-12T00:00:00Z"}, {"advisory": "RHSA-2024:9315", "cpe": "cpe:/o:redhat:enterprise_linux:9", "package": "kernel-0:5.14.0-503.11.1.el9_5", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2024-11-12T00:00:00Z"}, {"advisory": "RHSA-2025:9584", "cpe": "cpe:/a:redhat:rhel_eus:9.4", "package": "kernel-0:5.14.0-427.74.1.el9_4", "product_name": "Red Hat Enterprise Linux 9.4 Extended Update Support", "release_date": "2025-06-25T00:00:00Z"}], "bugzilla": {"description": "kernel: net/sched: flower: Fix chain template offload", "id": "2272795", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2272795"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.1", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "status": "verified"}, "cwe": "CWE-402", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nnet/sched: flower: Fix chain template offload\nWhen a qdisc is deleted from a net device the stack instructs the\nunderlying driver to remove its flow offload callback from the\nassociated filter block using the 'FLOW_BLOCK_UNBIND' command. The stack\nthen continues to replay the removal of the filters in the block for\nthis driver by iterating over the chains in the block and invoking the\n'reoffload' operation of the classifier being used. In turn, the\nclassifier in its 'reoffload' operation prepares and emits a\n'FLOW_CLS_DESTROY' command for each filter.\nHowever, the stack does not do the same for chain templates and the\nunderlying driver never receives a 'FLOW_CLS_TMPLT_DESTROY' command when\na qdisc is deleted. This results in a memory leak [1] which can be\nreproduced using [2].\nFix by introducing a 'tmplt_reoffload' operation and have the stack\ninvoke it with the appropriate arguments as part of the replay.\nImplement the operation in the sole classifier that supports chain\ntemplates (flower) by emitting the 'FLOW_CLS_TMPLT_{CREATE,DESTROY}'\ncommand based on whether a flow offload callback is being bound to a\nfilter block or being unbound from one.\nAs far as I can tell, the issue happens since cited commit which\nreordered tcf_block_offload_unbind() before tcf_block_flush_all_chains()\nin __tcf_block_put(). The order cannot be reversed as the filter block\nis expected to be freed after flushing all the chains.\n[1]\nunreferenced object 0xffff888107e28800 (size 2048):\ncomm \"tc\", pid 1079, jiffies 4294958525 (age 3074.287s)\nhex dump (first 32 bytes):\nb1 a6 7c 11 81 88 ff ff e0 5b b3 10 81 88 ff ff ..|......[......\n01 00 00 00 00 00 00 00 e0 aa b0 84 ff ff ff ff ................\nbacktrace:\n[<ffffffff81c06a68>] __kmem_cache_alloc_node+0x1e8/0x320\n[<ffffffff81ab374e>] __kmalloc+0x4e/0x90\n[<ffffffff832aec6d>] mlxsw_sp_acl_ruleset_get+0x34d/0x7a0\n[<ffffffff832bc195>] mlxsw_sp_flower_tmplt_create+0x145/0x180\n[<ffffffff832b2e1a>] mlxsw_sp_flow_block_cb+0x1ea/0x280\n[<ffffffff83a10613>] tc_setup_cb_call+0x183/0x340\n[<ffffffff83a9f85a>] fl_tmplt_create+0x3da/0x4c0\n[<ffffffff83a22435>] tc_ctl_chain+0xa15/0x1170\n[<ffffffff838a863c>] rtnetlink_rcv_msg+0x3cc/0xed0\n[<ffffffff83ac87f0>] netlink_rcv_skb+0x170/0x440\n[<ffffffff83ac6270>] netlink_unicast+0x540/0x820\n[<ffffffff83ac6e28>] netlink_sendmsg+0x8d8/0xda0\n[<ffffffff83793def>] ____sys_sendmsg+0x30f/0xa80\n[<ffffffff8379d29a>] ___sys_sendmsg+0x13a/0x1e0\n[<ffffffff8379d50c>] __sys_sendmsg+0x11c/0x1f0\n[<ffffffff843b9ce0>] do_syscall_64+0x40/0xe0\nunreferenced object 0xffff88816d2c0400 (size 1024):\ncomm \"tc\", pid 1079, jiffies 4294958525 (age 3074.287s)\nhex dump (first 32 bytes):\n40 00 00 00 00 00 00 00 57 f6 38 be 00 00 00 00 @.......W.8.....\n10 04 2c 6d 81 88 ff ff 10 04 2c 6d 81 88 ff ff ..,m......,m....\nbacktrace:\n[<ffffffff81c06a68>] __kmem_cache_alloc_node+0x1e8/0x320\n[<ffffffff81ab36c1>] __kmalloc_node+0x51/0x90\n[<ffffffff81a8ed96>] kvmalloc_node+0xa6/0x1f0\n[<ffffffff82827d03>] bucket_table_alloc.isra.0+0x83/0x460\n[<ffffffff82828d2b>] rhashtable_init+0x43b/0x7c0\n[<ffffffff832aed48>] mlxsw_sp_acl_ruleset_get+0x428/0x7a0\n[<ffffffff832bc195>] mlxsw_sp_flower_tmplt_create+0x145/0x180\n[<ffffffff832b2e1a>] mlxsw_sp_flow_block_cb+0x1ea/0x280\n[<ffffffff83a10613>] tc_setup_cb_call+0x183/0x340\n[<ffffffff83a9f85a>] fl_tmplt_create+0x3da/0x4c0\n[<ffffffff83a22435>] tc_ctl_chain+0xa15/0x1170\n[<ffffffff838a863c>] rtnetlink_rcv_msg+0x3cc/0xed0\n[<ffffffff83ac87f0>] netlink_rcv_skb+0x170/0x440\n[<ffffffff83ac6270>] netlink_unicast+0x540/0x820\n[<ffffffff83ac6e28>] netlink_sendmsg+0x8d8/0xda0\n[<ffffffff83793def>] ____sys_sendmsg+0x30f/0xa80\n[2]\n# tc qdisc add dev swp1 clsact\n# tc chain add dev swp1 ingress proto ip chain 1 flower dst_ip 0.0.0.0/32\n# tc qdisc del dev\n---truncated---"], "name": "CVE-2024-26669", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-04-02T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-26669\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-26669\nhttps://lore.kernel.org/linux-cve-announce/2024040237-CVE-2024-26669-ca3c@gregkh/T"], "threat_severity": "Low"}

{}