https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 16:51:19 +0000 https://vulnerability.circl.lu/vuln/cve-2024-56638 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>netfilter: nft_inner: incorrect percpu area handling under softirq</p> <p>Softirq can interrupt ongoing packet from process context that is walking over the percpu area that contains inner header offsets.</p> <p>Disable bh and perform three checks before restoring the percpu inner header offsets to validate that the percpu area is valid for this skbuff:</p> <p>1) If the NFT_PKTINFO_INNER_FULL flag is set on, then this skbuff has already been parsed before for inner header fetching to register.</p> <p>2) Validate that the percpu area refers to this skbuff using the skbuff pointer as a cookie. If there is a cookie mismatch, then this skbuff needs to be parsed again.</p> <p>3) Finally, validate if the percpu area refers to this tunnel type.</p> <p>Only after these three checks the percpu area is restored to a on-stack copy and bh is enabled again.</p> <p>After inner header fetching, the on-stack copy is stored back to the percpu area.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>netfilter: nft_inner: incorrect percpu area handling under softirq</p> <p>Softirq can interrupt ongoing packet from process context that is walking over the percpu area that contains inner header offsets.</p> <p>Disable bh and perform three checks before restoring the percpu inner header offsets to validate that the percpu area is valid for this skbuff:</p> <p>1) If the NFT_PKTINFO_INNER_FULL flag is set on, then this skbuff has already been parsed before for inner header fetching to register.</p> <p>2) Validate that the percpu area refers to this skbuff using the skbuff pointer as a cookie. If there is a cookie mismatch, then this skbuff needs to be parsed again.</p> <p>3) Finally, validate if the percpu area refers to this tunnel type.</p> <p>Only after these three checks the percpu area is restored to a on-stack copy and bh is enabled again.</p> <p>After inner header fetching, the on-stack copy is stored back to the percpu area.</p> https://vulnerability.circl.lu/vuln/cve-2024-56638