CVE-2024-26910: netfilter: ipset: fix performance regression in swap operation
In the Linux kernel, the following vulnerability has been resolved:
netfilter: ipset: fix performance regression in swap operation
The patch "netfilter: ipset: fix race condition between swap/destroy and kernel side add/del/test", commit 28628fa9 fixes a race condition. But the synchronizercu() added to the swap function unnecessarily slows it down: it can safely be moved to destroy and use callrcu() instead.
Eric Dumazet pointed out that simply calling the destroy functions as rcu callback does not work: sets with timeout use garbage collectors which need cancelling at destroy which can wait. Therefore the destroy functions are split into two: cancelling garbage collectors safely at executing the command received by netlink and moving the remaining part only into the rcu callback.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-26910?
CVE-2024-26910 has been classified as a performance regression issue affecting the netfilter ipset.
How do I fix CVE-2024-26910?
To resolve CVE-2024-26910, update your Linux kernel to one of the fixed versions, such as 5.10.223-1 or higher.
Which Linux kernel versions are affected by CVE-2024-26910?
CVE-2024-26910 affects various versions of the Linux kernel, including versions prior to 5.10.223 and various ranges up to 6.7.
What types of systems are vulnerable to CVE-2024-26910?
Systems running vulnerable versions of the Linux kernel using the netfilter ipset feature are susceptible to CVE-2024-26910.
What is the nature of CVE-2024-26910?
CVE-2024-26910 represents a race condition in the swap operation of the ipset, which can impact system performance.