Skip to content

[ciqlts8_6] netfilter: nf_tables: do not allow RULE_ID to refer to another chain - #1724

Merged
PlaidCat merged 1 commit into
ciqlts8_6from
{maple}_ciqlts8_6
Oct 23, 2026
Merged

[ciqlts8_6] netfilter: nf_tables: do not allow RULE_ID to refer to another chain#1724
PlaidCat merged 1 commit into
ciqlts8_6from
{maple}_ciqlts8_6

Conversation

@ciq-kernel-automation

@ciq-kernel-automation ciq-kernel-automation Bot commented Oct 21, 2026 •
edited
Loading

Copy link
Copy Markdown

Summary

This PR has been automatically created after successful completion of all CI stages.

Commit Message(s)

netfilter: nf_tables: do not allow RULE_ID to refer to another chain

jira VULN-3159
cve CVE-2022-2586
commit-author Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
commit 36d5b2913219ac853908b0f1c664345e04313856

Test Results

✅ Build Stage

Architecture Build Time Total Time
x86_64 23m 39s 24m 35s
aarch64 9m 28s 10m 12s

✅ Boot Verification

✅ Kernel Selftests

Architecture Passed Failed Compared Against Status
x86_64 108 31 ciqlts8_6 ✅ No regressions
aarch64 66 21 ciqlts8_6 ✅ No regressions

✅ LTP Results

Architecture Passed Failed Compared Against Status
x86_64 1456 13 ciqlts8_6 ✅ No regressions
aarch64 1425 14 ciqlts8_6 ✅ No regressions

x86_64 newly passing:

  • futex_wake02 (FAIL -> PASS)

🤖 This PR was automatically generated by GitHub Actions
Run ID: 39687904247

@ciq-kernel-automation ciq-kernel-automation Bot added the created-by-kernelci Tag PRs that were automatically created when a user branch was pushed to the repo (kernelCI) label Oct 21, 2026
@github-actions

github-actions Bot commented Oct 21, 2026

Copy link
Copy Markdown

🤖 Validation Checks In Progress Workflow run: https://github.com/ctrliq/kernel-src-tree/actions/runs/39681983376

@github-actions

github-actions Bot commented Oct 21, 2026

Copy link
Copy Markdown

🔍 Upstream Linux Kernel Commit Check

  • ❗ PR commit ad4df08fade1 (netfilter: nf_tables: do not allow RULE_ID to refer to another chain) references upstream commit
    67ea6fc0fffa which does not exist in the upstream Linux kernel.

  • ❌ PR commit ad4df08fade1 (netfilter: nf_tables: do not allow RULE_ID to refer to another chain) references CVE-2022-2586 but
    upstream commit 36d5b2913219 has no CVE assigned

This is an automated message from the kernel commit checker workflow.

@github-actions

github-actions Bot commented Oct 21, 2026

Copy link
Copy Markdown

❌ Diffofdiffs: 1 backport couldn't be compared with upstream

Warning

1 backport couldn't be compared. Details are in the workflow run log.

1. netfilter: nf_tables: do not allow RULE_ID to refer to another chain

Backport: ad4df08fade1 · Upstream: Unavailable

Show error 
The commit message names more than one upstream commit

Checked PR revision ad4df08fade1 against base e4bdfd796c2b.

@github-actions

github-actions Bot commented Oct 21, 2026

Copy link
Copy Markdown

✅ Validation checks completed successfully View full results: https://github.com/ctrliq/kernel-src-tree/actions/runs/39681983376

@PlaidCat PlaidCat self-assigned this Oct 21, 2026
@PlaidCat
PlaidCat requested a review from a team October 21, 2026 22:34
@PlaidCat
netfilter: nf_tables: do not allow RULE_ID to refer to another chain
42712f0 
jira VULN-3159
cve CVE-2022-2586
commit-author Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
commit 36d5b29

When doing lookups for rules on the same batch by using its ID, a rule from
a different chain can be used. If a rule is added to a chain but tries to
be positioned next to a rule from a different chain, it will be linked to
chain2, but the use counter on chain1 would be the one to be incremented.

When looking for rules by ID, use the chain that was used for the lookup by
name. The chain used in the context copied to the transaction needs to
match that same chain. That way, struct nft_rule does not need to get
enlarged with another member.

Fixes: 1a94e38 ("netfilter: nf_tables: add NFTA_RULE_ID attribute")
Fixes: 75dd48e ("netfilter: nf_tables: Support RULE_ID reference in new rule")
	Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
	Cc: <stable@vger.kernel.org>
	Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
(cherry picked from commit 36d5b29)
	Signed-off-by: Jonathan Maple <jmaple@ciq.com>
(cherry picked from commit 67ea6fc)
Signed-off-by: Jonathan Maple <jmaple@ciq.com>
@github-actions

github-actions Bot commented Oct 21, 2026

Copy link
Copy Markdown

🤖 Validation Checks In Progress Workflow run: https://github.com/ctrliq/kernel-src-tree/actions/runs/39688913621

@github-actions

github-actions Bot commented Oct 21, 2026

Copy link
Copy Markdown

🔍 Diffofdiffs: 1 backport differs from upstream

View the diffofdiffs report.

Open to anyone signed in to GitHub. Report expires 2027-01-19 22:37 UTC.

# Subject Backport Upstream
1 netfilter: nf_tables: do not allow RULE_ID to refer to another chain 42712f064444 36d5b2913219

Checked PR revision 42712f064444 against base e4bdfd796c2b.

@github-actions

github-actions Bot commented Oct 21, 2026

Copy link
Copy Markdown

🔍 Upstream Linux Kernel Commit Check

  • ❌ PR commit 42712f064444 (netfilter: nf_tables: do not allow RULE_ID to refer to another chain) references CVE-2022-2586 but
    upstream commit 36d5b2913219 has no CVE assigned

This is an automated message from the kernel commit checker workflow.

@github-actions

github-actions Bot commented Oct 21, 2026

Copy link
Copy Markdown

✅ Validation checks completed successfully View full results: https://github.com/ctrliq/kernel-src-tree/actions/runs/39688913621

@bmastbergen

bmastbergen commented Oct 22, 2026

Copy link
Copy Markdown
Collaborator

🔍 Upstream Linux Kernel Commit Check

  • ❌ PR commit 42712f064444 (netfilter: nf_tables: do not allow RULE_ID to refer to another chain) references CVE-2022-2586 but
    upstream commit 36d5b2913219 has no CVE assigned

This is an automated message from the kernel commit checker workflow.

@PlaidCat mentioned to me on slack that although this commit isn't officially associated with the CVE, it should be

bmastbergen
bmastbergen approved these changes Oct 22, 2026
View reviewed changes

@bmastbergen bmastbergen left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🥌

@bmastbergen
bmastbergen requested a review from a team October 22, 2026 13:32
@PlaidCat

PlaidCat commented Oct 22, 2026

Copy link
Copy Markdown
Collaborator

🔍 Upstream Linux Kernel Commit Check

  • ❌ PR commit 42712f064444 (netfilter: nf_tables: do not allow RULE_ID to refer to another chain) references CVE-2022-2586 but
    upstream commit 36d5b2913219 has no CVE assigned

This is an automated message from the kernel commit checker workflow.

@PlaidCat mentioned to me on slack that although this commit isn't officially associated with the CVE, it should be

Specifically this CVE existed before the KERNEL CNA, we always have this problem as pre-KernelCNA there isn't always a great 1:1 mapping of SHA to CVEID

@PlaidCat
PlaidCat merged commit b99a744 into ciqlts8_6 Oct 23, 2026
5 of 6 checks passed
@PlaidCat
PlaidCat deleted the {maple}_ciqlts8_6 branch October 23, 2026 13:12
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@bmastbergen bmastbergen bmastbergen approved these changes
@shreeya-patel98 shreeya-patel98 shreeya-patel98 approved these changes

Assignees

@PlaidCat PlaidCat

Labels

created-by-kernelci Tag PRs that were automatically created when a user branch was pushed to the repo (kernelCI)

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@bmastbergen @PlaidCat @shreeya-patel98