UnratedFix available
netfilter: ipset: fix performance regression in swap operation
Type: advisorySources: OSV
In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: fix performance regression in swap operation The patch "netfilter: ipset: fix race condition between swap/destroy and kernel side add/del/test", commit 28628fa9 fixes a race condition. But the synchronize_rcu() added to the swap function unnecessarily slows it down: it can safely be moved to destroy and use call_rcu() instead. Eric Dumazet pointed out that simply calling the destroy functions as rcu callback does not work: sets with timeout use garbage collectors which need cancelling at destroy which can wait. Therefore the destroy functions are split into two: cancelling garbage collectors safely at executing the command received by netlink and moving the remaining part only into the rcu callback.
- Products
- Kernel
- Affected versions
- Not specified
- Fixed versions
- 5.10.210, 5.15.149, 5.4.269, 6.1.79, 6.6.18, 6.7.6
- CVEs
- CVE-2024-26910
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 3 Nov 2026, 07:00 UTC · Revision 1
Source evidence
netfilter: ipset: fix performance regression in swap operation
core-osv · Original sourcePublished 17 Apr 2024, 15:59 UTC
In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: fix performance regression in swap operation The patch "netfilter: ipset: fix race condition between swap/destroy and kernel side add/del/test", commit 28628fa9 fixes a race condition. But the synchronize_rcu() added to the swap function unnecessarily slows it down: it can safely be moved to destroy and use call_rcu() instead. Eric Dumazet pointed out that simply calling the destroy functions as rcu callback does not work: sets with timeout use garbage collectors which need cancelling at destroy which can wait. Therefore the destroy functions are split into two: cancelling garbage collectors safely at executing the command received by netlink and moving the remaining part only into the rcu callback.
osv:CVE-2024-26910
Kernel
Fixed versions: 5.4.269, 5.10.210, 5.15.149, 6.1.79, 6.6.18, 6.7.6
Complete source record
{
"id": "4c6f2d2b822765ffe7a69b8c16a0327bf97e092df620e96cd40da1bd9c10f9eb",
"url": "https://osv.dev/vulnerability/CVE-2024-26910",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "netfilter: ipset: fix performance regression in swap operation",
"summary": "In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: fix performance regression in swap operation The patch \"netfilter: ipset: fix race condition between swap/destroy and kernel side add/del/test\", commit 28628fa9 fixes a race condition. But the synchronize_rcu() added to the swap function unnecessarily slows it down: it can safely be moved to destroy and use call_rcu() instead. Eric Dumazet pointed out that simply calling the destroy functions as rcu callback does not work: sets with timeout use garbage collectors which need cancelling at destroy which can wait. Therefore the destroy functions are split into two: cancelling garbage collectors safely at executing the command received by netlink and moving the remaining part only into the rcu callback.",
"evidence": "osv:CVE-2024-26910",
"products": [
{
"name": {
"value": "Kernel",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "5.4.269",
"evidence": "/affected/1/ranges"
},
{
"value": "5.10.210",
"evidence": "/affected/1/ranges"
},
{
"value": "5.15.149",
"evidence": "/affected/1/ranges"
},
{
"value": "6.1.79",
"evidence": "/affected/1/ranges"
},
{
"value": "6.6.18",
"evidence": "/affected/1/ranges"
},
{
"value": "6.7.6",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
}
],
"severity": "unknown",
"structured": {
"id": "CVE-2024-26910",
"aliases": [
"CVE-2024-26910"
],
"affected": [
{
"ranges": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "427deb5ba5661c4ae1cfb35955d2e01bd5f3090a"
},
{
"fixed": "c7f2733e5011bfd136f1ca93497394d43aa76225"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "e7152a138a5ac77439ff4e7a7533448a7d4c260d"
},
{
"fixed": "a24d5f2ac8ef702a58e55ec276aad29b4bd97e05"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "8bb930c3a1eacec1b14817f565ff81667c7c5dfa"
},
{
"fixed": "c2dc077d8f722a1c73a24e674f925602ee5ece49"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "875ee3a09e27b7adb7006ca6d16faf7f33415aa5"
},
{
"fixed": "653bc5e6d9995d7d5f497c665b321875a626161c"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "23c31036f862582f98386120aee55c9ae23d7899"
},
{
"fixed": "b93a6756a01f4fd2f329a39216f9824c56a66397"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "28628fa952fefc7f2072ce6e8016968cc452b1ba"
},
{
"fixed": "970709a67696b100a57b33af1a3d75fc34b747eb"
},
{
"fixed": "97f7cf1cd80eeed3b7c808b7c12463295c751001"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "5.4.264"
},
{
"fixed": "5.4.269"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "5.10.204"
},
{
"fixed": "5.10.210"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "5.15.143"
},
{
"fixed": "5.15.149"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "6.1.68"
},
{
"fixed": "6.1.79"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "6.6.7"
},
{
"fixed": "6.6.18"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "4.19.302"
},
{
"fixed": "4.20"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "a12606e5ad0cee8f4ba3ec68561c4d6275d2df57"
}
]
}
],
"versions": [
"v5.4.268",
"v5.4.267",
"v5.4.266",
"v5.4.265",
"v5.4.264",
"v5.10.209",
"v5.10.208",
"v5.10.207",
"v5.10.206",
"v5.10.205",
"v5.10.204",
"v5.15.148",
"v5.15.147",
"v5.15.146",
"v5.15.145",
"v5.15.144",
"v5.15.143",
"v6.1.78",
"v6.1.77",
"v6.1.76",
"v6.1.75",
"v6.1.74",
"v6.1.73",
"v6.1.72",
"v6.1.71",
"v6.1.70",
"v6.1.69",
"v6.1.68",
"v6.6.17",
"v6.6.16",
"v6.6.15",
"v6.6.14",
"v6.6.13",
"v6.6.12",
"v6.6.11",
"v6.6.10",
"v6.6.9",
"v6.6.8",
"v6.6.7",
"v4.19.325",
"v4.19.324",
"v4.19.323",
"v4.19.322",
"v4.19.321",
"v4.19.320",
"v4.19.319",
"v4.19.318",
"v4.19.317",
"v4.19.316",
"v4.19.315",
"v4.19.314",
"v4.19.313",
"v4.19.312",
"v4.19.311",
"v4.19.310",
"v4.19.309",
"v4.19.308",
"v4.19.307",
"v4.19.306",
"v4.19.305",
"v4.19.304",
"v4.19.303",
"v4.19.302"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-26910.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "5.4.269"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.5.0"
},
{
"fixed": "5.10.210"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.11.0"
},
{
"fixed": "5.15.149"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.16.0"
},
{
"fixed": "6.1.79"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.2.0"
},
{
"fixed": "6.6.18"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.7.0"
},
{
"fixed": "6.7.6"
}
]
}
],
"package": {
"name": "Kernel",
"ecosystem": "Linux"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-26910.json"
}
}
],
"modified": "2026-10-28T02:30:26.804574940Z",
"provider": "osv",
"references": [
"https://git.kernel.org/stable/c/653bc5e6d9995d7d5f497c665b321875a626161c",
"https://git.kernel.org/stable/c/970709a67696b100a57b33af1a3d75fc34b747eb",
"https://git.kernel.org/stable/c/97f7cf1cd80eeed3b7c808b7c12463295c751001",
"https://git.kernel.org/stable/c/a24d5f2ac8ef702a58e55ec276aad29b4bd97e05",
"https://git.kernel.org/stable/c/b93a6756a01f4fd2f329a39216f9824c56a66397",
"https://git.kernel.org/stable/c/c2dc077d8f722a1c73a24e674f925602ee5ece49",
"https://git.kernel.org/stable/c/c7f2733e5011bfd136f1ca93497394d43aa76225",
"https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/26xxx/CVE-2024-26910.json",
"https://nvd.nist.gov/vuln/detail/CVE-2024-26910",
"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
],
"provider_metadata": {
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/26xxx/CVE-2024-26910.json"
}
},
"related_cves": [
{
"value": "CVE-2024-26910",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": null
},
"source_id": "core-osv",
"document_id": 493186,
"published_at": "2024-04-17T15:59:21.967+00:00"
}