In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_tables: don't unregister hook when table is dormant
When nftablesupdchain encounters an error, hook registration needs to be rolled back.
This should only be done if the hook has been registered, which won't happen when the table is flagged as dormant (inactive).
Just move the assignment into the registration block.
[
{
"deprecated": false,
"digest": {
"line_hashes": [
"80614333730288585635782011117530597427",
"106439060636098173743783123730708674052",
"170033876867480070094737887813055007923",
"12202343058421985016049351065297766616",
"59873657222788647711547656231850495256",
"208178654261781636196868223906000873132",
"134585928945518669545867352480384222241"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ce571eba07d54e3637bf334bc48376fbfa55defe",
"target": {
"file": "net/netfilter/nf_tables_api.c"
},
"id": "CVE-2025-22064-0d83b883",
"signature_type": "Line",
"signature_version": "v1"
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"80614333730288585635782011117530597427",
"106439060636098173743783123730708674052",
"170033876867480070094737887813055007923",
"12202343058421985016049351065297766616",
"59873657222788647711547656231850495256",
"208178654261781636196868223906000873132",
"134585928945518669545867352480384222241"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@feb1fa2a03a27fec7001e93e4223be4120d1784b",
"target": {
"file": "net/netfilter/nf_tables_api.c"
},
"id": "CVE-2025-22064-14baa906",
"signature_type": "Line",
"signature_version": "v1"
},
{
"deprecated": false,
"digest": {
"function_hash": "187990945553681854220306094125500632820",
"length": 3744.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ce571eba07d54e3637bf334bc48376fbfa55defe",
"target": {
"file": "net/netfilter/nf_tables_api.c",
"function": "nf_tables_updchain"
},
"id": "CVE-2025-22064-21288240",
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"80614333730288585635782011117530597427",
"106439060636098173743783123730708674052",
"170033876867480070094737887813055007923",
"12202343058421985016049351065297766616",
"59873657222788647711547656231850495256",
"208178654261781636196868223906000873132",
"134585928945518669545867352480384222241"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@03d1fb457b696c18fe15661440c4f052b2374e7e",
"target": {
"file": "net/netfilter/nf_tables_api.c"
},
"id": "CVE-2025-22064-32a0f9d6",
"signature_type": "Line",
"signature_version": "v1"
},
{
"deprecated": false,
"digest": {
"function_hash": "187990945553681854220306094125500632820",
"length": 3744.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@03d1fb457b696c18fe15661440c4f052b2374e7e",
"target": {
"file": "net/netfilter/nf_tables_api.c",
"function": "nf_tables_updchain"
},
"id": "CVE-2025-22064-347e19c0",
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"80614333730288585635782011117530597427",
"106439060636098173743783123730708674052",
"170033876867480070094737887813055007923",
"12202343058421985016049351065297766616",
"59873657222788647711547656231850495256",
"208178654261781636196868223906000873132",
"134585928945518669545867352480384222241"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@688c15017d5cd5aac882400782e7213d40dc3556",
"target": {
"file": "net/netfilter/nf_tables_api.c"
},
"id": "CVE-2025-22064-4527fb37",
"signature_type": "Line",
"signature_version": "v1"
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"80614333730288585635782011117530597427",
"106439060636098173743783123730708674052",
"170033876867480070094737887813055007923",
"12202343058421985016049351065297766616",
"59873657222788647711547656231850495256",
"208178654261781636196868223906000873132",
"134585928945518669545867352480384222241"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6134d1ea1e1408e8e7c8c26545b3b301cbdf1eda",
"target": {
"file": "net/netfilter/nf_tables_api.c"
},
"id": "CVE-2025-22064-6867ef9b",
"signature_type": "Line",
"signature_version": "v1"
},
{
"deprecated": false,
"digest": {
"function_hash": "187990945553681854220306094125500632820",
"length": 3744.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@688c15017d5cd5aac882400782e7213d40dc3556",
"target": {
"file": "net/netfilter/nf_tables_api.c",
"function": "nf_tables_updchain"
},
"id": "CVE-2025-22064-761779d9",
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"digest": {
"function_hash": "187990945553681854220306094125500632820",
"length": 3744.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@feb1fa2a03a27fec7001e93e4223be4120d1784b",
"target": {
"file": "net/netfilter/nf_tables_api.c",
"function": "nf_tables_updchain"
},
"id": "CVE-2025-22064-da70f69b",
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"digest": {
"function_hash": "195795095397753981380554575260810874490",
"length": 3771.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6134d1ea1e1408e8e7c8c26545b3b301cbdf1eda",
"target": {
"file": "net/netfilter/nf_tables_api.c",
"function": "nf_tables_updchain"
},
"id": "CVE-2025-22064-f4725c56",
"signature_type": "Function",
"signature_version": "v1"
}
]