netfilter: ipset: Don't use test_bit() in lockless RCU readers in hash types

Summary

In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: Don't use test_bit() in lockless RCU readers in hash types Sashiko pointed out that there are a few lockless RCU readers using test_bit() which is a relaxed atomic operation and provides no memory barrier guarantees. Use test_bit_acquire() instead where the operation may run parallel with add/del/gc, i.e. is not one from the next cases • protected by region lock • in a set destroy phase • in a new/temporary set creation phase

Timeline

1. Aug 15, 2026, 5:56 AM UTCCVE published
2. Oct 16, 2026, 6:49 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: yes · Technical impact: total

3. Oct 16, 2026, 6:55 PM UTCRecord last updated

Affected versions

• Linux Linux

  From 18f84d41d34fa35d0d64bbaea01fe664553ecc06 · fixed in c107233d2ff4fd7cef5d02f9124b99194957a710; From 18f84d41d34fa35d0d64bbaea01fe664553ecc06 · fixed in 6329d3a9afe715fddda0460cfa46b496d61c2fe0; From 18f84d41d34fa35d0d64bbaea01fe664553ecc06 · fixed in 7445fe965b7d8756070a40e80f8b73348ccda1d7; From 18f84d41d34fa35d0d64bbaea01fe664553ecc06 · fixed in c4d257734e91bfcdc71d41843392dd6400b5bb1b; From 18f84d41d34fa35d0d64bbaea01fe664553ecc06 · fixed in 3219d74e4536658c937fd878a327257b86ce80dd; From 18f84d41d34fa35d0d64bbaea01fe664553ecc06 · fixed in e4b4984e28c16406ecb318444dea4a8bf47def3e

• Linux Linux

  4.2

• KernelLinux

  From 4.2.0 · fixed in 6.1.178; From 6.2.0 · fixed in 6.6.145; From 6.7.0 · fixed in 6.12.97; From 6.13.0 · fixed in 6.18.40; From 6.19.0 · fixed in 7.1.5

References 6