CVE-2026-72434: netfilter: ipset: make sure gc is properly stopped
In the Linux kernel, the following vulnerability has been resolved:
netfilter: ipset: make sure gc is properly stopped
Sashiko noticed that when destroying a set, canceldelayedworksync() was called while gc calls queuedelayedwork() unconditionally which can lead not to properly shutting down the gc.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Ensure gc is properly stopped by calling cancel_delayed_work_sync() when destroying the set, rather than unconditionally calling queue_delayed_work() in this shutdown path.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72434?
CVE-2026-72434 has a risk score of 23, indicating a significant security vulnerability in the Linux kernel.
How do I fix CVE-2026-72434?
To fix CVE-2026-72434, update your Linux kernel to the latest version where the vulnerability has been resolved.
What systems are affected by CVE-2026-72434?
CVE-2026-72434 affects various distributions of the Linux kernel that utilize netfilter and ipset.
What are the potential consequences of CVE-2026-72434?
The potential consequences of CVE-2026-72434 include improper garbage collection leading to system instability and security risks.
Who discovered CVE-2026-72434?
CVE-2026-72434 was discovered by a researcher named Sashiko.