Executive Summary

This vulnerability exists in the Linux kernel's netfilter synproxy component. The issue arises because the synproxy infrastructure registers netfilter hooks on-demand when a user adds the first iptables target or nftables expression. If multiple such registrations happen concurrently, they can race each other, leading to potential inconsistencies.

To fix this, a mutex was introduced to serialize access to the reference counting control blocks from both frontends, preventing race conditions during hook registration.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to race conditions during the registration of netfilter hooks in the Linux kernel. Such race conditions might cause instability or unexpected behavior in the kernel's packet filtering mechanisms, potentially affecting network security or system reliability.

Useful 0 Not Useful 0