一线运维实战手记 · 云计算 · 数据库 · 故障排查
2026年9月4日

CVE-2026-72436 [CRITICAL] – In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: Don

未分类
📑 文章目录

In the Linux kernel, the following vulnerability has been resolved:

netfilter: ipset: Don’t use test_bit() in lockless RCU readers in hash types

Sashiko pointed out that there are a few lockless RCU readers
using test_bit() which is a relaxed atomic operation and
provides no memory barrier guarantees. Use test_bit_acquire()
instead where the operation may run parallel with add/del/gc,
i.e. is not one from the next cases

– protected by region lock
– in a set destroy phase
– in a new/temporary set creation phase