CVE-2026-90061

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_tables: skip double clone set expressions on element insert

Both the dynset and newsetelem path clone the existing set expressions

when setting set element expressions if no override expressions are

provided. This results in a double clone, once to clone the template set

expressions then another clone on the new element. Add a flag to

annotate if userspace provides a override expression (ie. expression of

the same type of the set but different configuration), otherwise borrow

the existing expression from the set. Add conditionals to release

expression iif they represent an override. Use this new override_exprs

flag to dump the dynset expression override to userspace.

This simplifies the existing logic and it also fixes a bug with the

connlimit expression which results in a module refcount imbalance

WARNING splat when resorting on the default set expressions.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References