CVE-2026-90061: netfilter: nf_tables: skip double clone set expressions on element insert
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nftables: skip double clone set expressions on element insert
Both the dynset and newsetelem path clone the existing set expressions when setting set element expressions if no override expressions are provided. This results in a double clone, once to clone the template set expressions then another clone on the new element. Add a flag to annotate if userspace provides a override expression (ie. expression of the same type of the set but different configuration), otherwise borrow the existing expression from the set. Add conditionals to release expression iif they represent an override. Use this new overrideexprs flag to dump the dynset expression override to userspace.
This simplifies the existing logic and it also fixes a bug with the connlimit expression which results in a module refcount imbalance WARNING splat when resorting on the default set expressions.
Affected Software
Event History
Frequently Asked Questions
What configurations are implicated by this issue?
The issue involves nf_tables set element expressions, specifically the dynset and newsetelem paths. The description identifies the connlimit expression as affected, where resorting default set expressions can trigger a module refcount imbalance warning.
What is required to trigger the reported warning?
The described failure occurs when the affected paths clone existing set expressions without userspace override expressions, resulting in a double clone. For connlimit, the warning is associated with resorting the default set expressions.
How can administrators identify possible impact?
Check kernel logs for a module refcount imbalance WARNING associated with the connlimit expression. Systems using nf_tables set expressions through the affected dynset or newsetelem paths are the relevant scope.