Linux Kernel Netfilter nf_tables Module Reference Underflow Vulnerability

A vulnerability in the Linux kernel's netfilter component, specifically within nf_tables, has been addressed. The issue involved a potential module reference underflow in the error handling path. When nft_expr_clone() failed, dst->ops was incorrectly set, leading to a situation where nft_expr_destroy() could cause a module reference underflow. This occurred because the module reference count had not been properly incremented before the error was handled.

Impact

Exploitation of this vulnerability could lead to a module reference underflow, potentially causing instability or unexpected behavior in the kernel module management.