CVE-2026-80837: netfilter: nf_tables: don't queue packet path object notifications

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nftables: don't queue packet path object notifications

All file:line references below are against v7.2-rc4 (ac5b0e5651b1). The trace was captured on 7.2.0-rc6-kasan72rc6 (075b74841bd0), where the same lines apply.

nftobjnotify() is exported and reached from the packet path. Its only in-tree caller is nftquotaobjeval() (net/netfilter/nftquota.c:68), which notifies with GFPATOMIC while evaluating a rule for a transiting packet, holding no mutex.

Since commit 67cc570edaa0 ("netfilter: nftables: coalesce multiple notifications into one skbuff") that notification is no longer sent immediately. nftobjnotify() queues it onto nftnet->notifylist via nftnotifyenqueue() (net/netfilter/nftablesapi.c:1211), which is a bare listaddtail(). notifylist has no lock of its own (include/net/netfilter/nftables.h:1951), it is serialised by commitmutex: the six other enqueue sites all run inside a netlink transaction, and the drain in nftcommitnotify() (net/netfilter/nftablesapi.c:10746) does listdel() + kfreeskb() from nftablescommit() with commitmutex held.

Sending packets through a chain that references a depleted quota object therefore races an unlocked listaddtail() against listdel() + kfreeskb() on another CPU. The WRITEONCE(prev->next, new) in listadd() then stores through an skbuff that has already been freed:

BUG: KASAN: slab-use-after-free in nftobjnotify+0x2c5/0x2d0 Write of size 8 at addr ff110001047183c0 by task poc/76 CPU: 0 UID: 1000 PID: 76 Comm: poc Tainted: G W 7.2.0-rc6-kasan72rc6 #4 Call Trace: <IRQ> nftobjnotify (include/linux/list.h:164 include/linux/list.h:191 net/netfilter/nftablesapi.c:1211 net/netfilter/nftablesapi.c:8743) nftquotaobjeval (net/netfilter/nftquota.c:68) nftdochaininet nfhookslow iplocalout ippushpendingframes udpsendskb udpsendmsg x64syssendto

Allocated by task 77: allocskb (net/core/skbuff.c:704) nftobjnotify (include/net/netlink.h:1055 net/netfilter/nftablesapi.c:8731) nftquotaobjeval (net/netfilter/nftquota.c:68) nftdochain

Freed by task 79: nftablescommit (include/linux/skbuff.h:1332 net/netfilter/nftablesapi.c:10759 net/netfilter/nftablesapi.c:11185) nfnetlinkrcvbatch (net/netfilter/nfnetlink.c:574) netlinkunicast netlinksendmsg

The buggy address belongs to the cache skbuffheadcache of size 232

Queueing from the packet path is wrong even leaving the race aside: notifylist is only drained by nftcommitnotify() from nftablescommit() (:11185), so a notification enqueued outside a transaction is not sent until some later netlink batch commits, if one ever does.

The gfp argument that nftobjnotify() still takes is a leftover of the pre-67cc570edaa0 behaviour, where this path called nfnetlinksend() directly. Restore that: split the message construction out into nftobjnotifyalloc() and let each caller decide what to do with the skb. nftobjnotify(), the exported one reached from the packet path, sends it straight away; nftablesobjnotify(), which runs under commitmutex, keeps queueing it, so transaction notifications are still coalesced.