Fixed
Created: Sep 3, 2025
Updated: Jun 1, 2026
Resolved Date: May 25, 2026
Found In Version: 10.22.33.1
Fix Version: 10.22.33.24
Severity: Standard
Applicable for: Wind River Linux LTS 22
Component/s: Kernel
In the Linux kernel, the following vulnerability has been resolved:[EOL][EOL]netfilter: nf_tables: reject duplicate device on updates[EOL][EOL]A chain/flowtable update with duplicated devices in the same batch is[EOL]possible. Unfortunately, netdev event path only removes the first[EOL]device that is found, leaving unregistered the hook of the duplicated[EOL]device.[EOL][EOL]Check if a duplicated device exists in the transaction batch, bail out[EOL]with EEXIST in such case.[EOL][EOL]WARNING is hit when unregistering the hook:[EOL][EOL] [49042.221275] WARNING: CPU: 4 PID: 8425 at net/netfilter/core.c:340 nf_hook_entry_head+0xaa/0x150[EOL] [49042.221375] CPU: 4 UID: 0 PID: 8425 Comm: nft Tainted: G S 6.16.0+ #170 PREEMPT(full)[EOL] [...][EOL] [49042.221382] RIP: 0010:nf_hook_entry_head+0xaa/0x150
