netfilter: ebtables: fix table blob use-after-free

MITRE NVD CVE.ORG JSON API

Summary

CVECVE-2023-54243
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2025-12-30 13:16:12 UTC
Updated2026-08-04 11:16:38 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: netfilter: ebtables: fix table blob use-after-free We are not allowed to return an error at this point. Looking at the code it looks like ret is always 0 at this point, but its not. t = find_table_lock(net, repl->name, &ret, &ebt_mutex); ... this can return a valid table, with ret != 0. This bug causes update of table->private with the new blob, but then frees the blob right away in the caller. Syzbot report: BUG: KASAN: vmalloc-out-of-bounds in __ebt_unregister_table+0xc00/0xcd0 net/bridge/netfilter/ebtables.c:1168 Read of size 4 at addr ffffc90005425000 by task kworker/u4:4/74 Workqueue: netns cleanup_net Call Trace: kasan_report+0xbf/0x1f0 mm/kasan/report.c:517 __ebt_unregister_table+0xc00/0xcd0 net/bridge/netfilter/ebtables.c:1168 ebt_unregister_table+0x35/0x40 net/bridge/netfilter/ebtables.c:1372 ops_exit_list+0xb0/0x170 net/core/net_namespace.c:169 cleanup_net+0x4ee/0xb10 net/core/net_namespace.c:613 ... ip(6)tables appears to be ok (ret should be 0 at this point) but make this more obvious.

Risk And Classification

Primary CVSS: v3.1 7.8 HIGH from 416baaa9-dc9f-4396-8d5f-8c081fb06d67

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.001300000 probability, percentile 0.030020000 (date 2026-08-06)

VersionSourceTypeScoreSeverityVector
3.1416baaa9-dc9f-4396-8d5f-8c081fb06d67Secondary7.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
3.1CNADECLARED7.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1 Breakdown

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected c58dd2dd443c26d856a168db108a0cd11c285bf3 9060abce3305ab2354c892c09d5689df51486df5 git Not specified
CNA Linux Linux affected c58dd2dd443c26d856a168db108a0cd11c285bf3 dbb3cbbf03b3c52cb390fabec357f1e4638004f5 git Not specified
CNA Linux Linux affected c58dd2dd443c26d856a168db108a0cd11c285bf3 3dd6ac973351308d4117eda32298a9f1d68764fd git Not specified
CNA Linux Linux affected c58dd2dd443c26d856a168db108a0cd11c285bf3 cda0e0243bd3c04008fcd37a46b0269fb3c49249 git Not specified
CNA Linux Linux affected c58dd2dd443c26d856a168db108a0cd11c285bf3 e58a171d35e32e6e8c37cfe0e8a94406732a331f git Not specified
CNA Linux Linux affected a3bc0f8ea439762aa62d40a295157410498cbea7 git Not specified
CNA Linux Linux affected 8ed40c122919cd79bc3c059e5864e5e7d9d455f0 git Not specified
CNA Linux Linux affected c5e4ef499cfc78de45a4f01b8c557b5964d77c53 git Not specified
CNA Linux Linux affected f34728610b2a8c7b9864f9404f2884c17f6fca5c git Not specified
CNA Linux Linux affected 8b5740915a9faa8b1fa9166193a33e2a9ae30ec6 git Not specified
CNA Linux Linux affected 3.2.60 3.3 semver Not specified
CNA Linux Linux affected 3.4.91 3.5 semver Not specified
CNA Linux Linux affected 3.10.41 3.11 semver Not specified
CNA Linux Linux affected 3.12.21 3.13 semver Not specified
CNA Linux Linux affected 3.14.5 3.15 semver Not specified
CNA Linux Linux affected 3.15 Not specified
CNA Linux Linux unaffected 3.15 semver Not specified
CNA Linux Linux unaffected 5.10.173 5.10.* semver Not specified
CNA Linux Linux unaffected 5.15.100 5.15.* semver Not specified
CNA Linux Linux unaffected 6.1.18 6.1.* semver Not specified
CNA Linux Linux unaffected 6.2.5 6.2.* semver Not specified
CNA Linux Linux unaffected 6.3 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/dbb3cbbf03b3c52cb390fabec357f1e4638004f5 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/3dd6ac973351308d4117eda32298a9f1d68764fd 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/e58a171d35e32e6e8c37cfe0e8a94406732a331f 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/cda0e0243bd3c04008fcd37a46b0269fb3c49249 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/9060abce3305ab2354c892c09d5689df51486df5 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report