Linux Kernel Netfilter nf_tables Duplicate Device Registration Vulnerability

A vulnerability in the Linux kernel's netfilter component, specifically within the nf_tables subsystem, has been addressed. This issue involved improper handling of NETDEV_REGISTER notifications, which could lead to duplicate device registrations. Such duplicates were problematic because the device might have already been registered by the nft_netdev_hook_alloc() function when the hook was created. The vulnerability affected the Linux kernel stable tree.

Impact

The vulnerability could cause issues with network device management, potentially leading to incorrect handling of network traffic or device events.

Reproduction

The vulnerability could be reproduced by creating a netfilter nf_tables hook and then triggering a NETDEV_REGISTER notification for the same network device. This would result in a duplicate registration, as the device had already been added by the nft_netdev_hook_alloc() function when the hook was created.

Remediation

Users can update to the latest version of the Linux kernel stable tree, where this vulnerability has been fixed.