netfilter: ipset: fix region locking in hash types

Summary

In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: fix region locking in hash types Region locking introduced in v5.6-rc4 contained three macros to handle the region locks: ahash_bucket_start(), ahash_bucket_end() which gave back the start and end hash bucket values belonging to a given region lock and ahash_region() which should give back the region lock belonging to a given hash bucket. The latter was incorrect which can lead to a race condition between the garbage collector and adding new elements when a hash type of set is defined with timeouts.

Timeline

1. May 29, 2025, 1:15 PM UTCCVE published
2. Oct 15, 2026, 9:46 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: total

3. Oct 15, 2026, 9:52 PM UTCRecord last updated

Affected versions

• Linux Linux

  From 5dd9488ae41070b69d2f4acb580f77db5705f9ca · fixed in 00cfc5fad1491796942a948808afb968a0a3f35b; From f66ee0410b1c3481ee75e5db9b34547b4d582465 · fixed in 226ce0ec38316d9e3739e73a64b6b8304646c658; From f66ee0410b1c3481ee75e5db9b34547b4d582465 · fixed in 82c1eb32693bc48251d92532975e19160987e5b9; From f66ee0410b1c3481ee75e5db9b34547b4d582465 · fixed in aa77294b0f73bb8265987591460cd25b8722c3df; From f66ee0410b1c3481ee75e5db9b34547b4d582465 · fixed in a3dfec485401943e315c394c29afe2db8f9481d6; From f66ee0410b1c3481ee75e5db9b34547b4d582465 · fixed in e2ab67672b2288521a6146034a971f9a82ffc5c5; From f66ee0410b1c3481ee75e5db9b34547b4d582465 · fixed in 6e002ecc1c8cfdfc866b9104ab7888da54613e59; From f66ee0410b1c3481ee75e5db9b34547b4d582465 · fixed in 8478a729c0462273188263136880480729e9efca; From 5.4.24 · fixed in 5.4.294; From 5.5.8 · fixed in 5.6

• Linux Linux

  5.6

• KernelLinux

  fixed in 5.4.294; From 5.5.0 · fixed in 5.10.238; From 5.6.0 · fixed in 5.15.183; From 5.11.0 · fixed in 6.1.139; From 5.16.0 · fixed in 6.6.91; From 6.2.0 · fixed in 6.12.29; From 6.7.0 · fixed in 6.14.7

References 8