Subject: CVE-2024-35897: netfilter: nf_tables: discard table flag update with pending basechain deletion

From: Greg Kroah-Hartman <[email-masked]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_tables: discard table flag update with pending basechain deletion

Hook unregistration is deferred to the commit phase, same occurs with
hook updates triggered by the table dormant flag. When both commands are
combined, this results in deleting a basechain while leaving its hook
still registered in the core.

The Linux kernel CVE team has assigned CVE-2024-35897 to this issue.

Affected and fixed versions
===========================

	Issue introduced in 5.4.262 with commit e10f661adc55 and fixed in 5.4.274 with commit 9a3b90904d8a
	Issue introduced in 5.10.202 with commit d9c4da8cb74e and fixed in 5.10.215 with commit b58d0ac35f6d
	Issue introduced in 5.13 with commit 179d9ba5559a and fixed in 5.15.155 with commit 6cbbe1ba76ee
	Issue introduced in 5.13 with commit 179d9ba5559a and fixed in 6.1.86 with commit 2aeb805a1bcd
	Issue introduced in 5.13 with commit 179d9ba5559a and fixed in 6.6.26 with commit 9627fd0c6ea1
	Issue introduced in 5.13 with commit 179d9ba5559a and fixed in 6.8.5 with commit 7f609f630951
	Issue introduced in 5.13 with commit 179d9ba5559a and fixed in 6.9 with commit 1bc83a019bbe

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2024-35897
will be updated if fixes are backported, please check that for the most
up to date information about this issue.

Affected files
==============

The file(s) affected by this issue are:
	net/netfilter/nf_tables_api.c

Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/e75faf01e22ec7dc671640fa0e0968964fafd2fc
	https://git.kernel.org/stable/c/9a3b90904d8a072287480eed4c3ece4b99d64f78
	https://git.kernel.org/stable/c/b58d0ac35f6d75ec1db8650a29dfd6f292c11362
	https://git.kernel.org/stable/c/6cbbe1ba76ee7e674a86abd43009b083a45838cb
	https://git.kernel.org/stable/c/2aeb805a1bcd5f27c8c0d1a9d4d653f16d1506f4
	https://git.kernel.org/stable/c/9627fd0c6ea1c446741a33e67bc5709c59923827
	https://git.kernel.org/stable/c/7f609f630951b624348373cef99991ce08831927
	https://git.kernel.org/stable/c/1bc83a019bbe268be3526406245ec28c2458a518