CVE-2026-45901: netfilter: nf_tables: revert commit_mutex usage in reset path
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nftables: revert commitmutex usage in reset path
It causes circular lock dependency between commitmutex, nfnlsubsysipset and nlkcbmutex when nft reset, ipset list, and iptables-nft with '-m set' rule run at the same time.
Previous patches made it safe to run individual reset handlers concurrently so commitmutex is no longer required to prevent this.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 6.8.0-147.147 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 6.8.0-1067.70 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 6.8.0-1071.79 - Upgrade
Upgrade
ubuntu/linux-azure-fdeto a version that resolves this vulnerability.Fixed in 6.8.0-1069.76 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 6.8.0-1071.79 - Upgrade
Upgrade
ubuntu/linux-gketo a version that resolves this vulnerability.Fixed in 6.8.0-1066.74 - Upgrade
Upgrade
ubuntu/linux-gkeopto a version that resolves this vulnerability.Fixed in 6.8.0-1052.56 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 6.8.0-1067.68 - Upgrade
Upgrade
ubuntu/linux-lowlatencyto a version that resolves this vulnerability.Fixed in 6.8.0-147.147.1 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 6.8.0-1064.67 - Upgrade
Upgrade
ubuntu/linux-bluefieldto a version that resolves this vulnerability.Fixed in 6.8.0-1033.38 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 6.8.1-1062.63 - Upgrade
Upgrade
ubuntu/linux-aws-fipsto a version that resolves this vulnerability.Fixed in 6.8.0-1067.70+fips1 - Upgrade
Upgrade
ubuntu/linux-azure-fipsto a version that resolves this vulnerability.Fixed in 6.8.0-1071.79+fips1 - Upgrade
Upgrade
ubuntu/linux-fipsto a version that resolves this vulnerability.Fixed in 6.8.0-147.147+fips1 - Upgrade
Upgrade
ubuntu/linux-gcp-fipsto a version that resolves this vulnerability.Fixed in 6.8.0-1071.79+fips1
Event History
Frequently Asked Questions
What access and activity are required to trigger this issue?
An attacker needs local, low-privileged access. The circular lock dependency occurs when an nft reset, an ipset list operation, and an iptables-nft rule using the '-m set' match run concurrently.
What is the practical impact?
The reported impact is availability loss. The concurrent operations can create a circular lock dependency involving commit_mutex, nfnl_subsys_ipset, and nlk_cb_mutex.
What can be done before the fix is available?
Avoid running nft reset, ipset list, and iptables-nft commands with '-m set' rules at the same time. The issue is specifically tied to concurrent execution of those operations.
Which listed platforms should be reviewed?
Review systems using the Linux kernel and the listed Ubuntu kernel packages: linux-riscv, linux-realtime, linux-azure, linux-gcp, linux-azure-fde, linux-hwe-edge, and linux-gke.