Linux Kernel Netfilter Expectation Management Vulnerability

A vulnerability in the Linux kernel's netfilter component has been addressed, concerning the management of connection tracking expectations. The issue arose because the function 'nf_conntrack_in()' would remove expectations from the hash table when calling 'nf_ct_find_expectation()'. However, in certain scenarios, such as with Open vSwitch (OVS) and Traffic Control (TC) connection tracking, it was expected that the expectation should remain intact, especially when the created connection tracking would not be confirmed. The recent patch modifies this behavior by allowing expectations to be retained by setting the 'IPS_CONFIRMED' status in the template.

Impact

The vulnerability could lead to improper management of connection tracking expectations, potentially causing issues in network traffic handling and processing.