CVE-2023-52923

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> netfilter: nf_tables: adapt set backend to use GC transaction API<br /> <br /> Use the GC transaction API to replace the old and buggy gc API and the<br /> busy mark approach.<br /> <br /> No set elements are removed from async garbage collection anymore,<br /> instead the _DEAD bit is set on so the set element is not visible from<br /> lookup path anymore. Async GC enqueues transaction work that might be<br /> aborted and retried later.<br /> <br /> rbtree and pipapo set backends does not set on the _DEAD bit from the<br /> sync GC path since this runs in control plane path where mutex is held.<br /> In this case, set elements are deactivated, removed and then released<br /> via RCU callback, sync GC never fails.