CyberRota Analysis
AI-GeneratedThe vulnerability affects the Linux kernel's netfilter component, specifically in the flowtable management, where improper handling of tuple nodes can lead to a use-after-free condition. This flaw may allow an attacker to exploit memory corruption, potentially leading to arbitrary code execution or system crashes. Organizations using Linux-based systems, particularly those relying on netfilter for network traffic management, should prioritize addressing this vulnerability to mitigate risks associated with memory safety issues.
Original NVD Description
In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: publish GC-visible tuple last nf_flow_table_iterate() only treats original-direction tuple nodes as owning entries. Publishing the original node first lets GC observe and free a flow while flow_offload_add() is still inserting the reply node. Publish the reply node first and the original node last so GC never sees a partially installed flow. KASAN can trigger slab-use-after-free read and write reports in the flowtable/rhashtable path (rht_deferred_worker, jhash, flow_offload_del, flow_offload_lookup, etc.).