Li Xiasong 7b96242cee netfilter: nft_ct: fix missing expect put in obj eval ...

commit 19f94b6fee upstream.

nft_ct_expect_obj_eval() allocates an expectation and may call
nf_ct_expect_related(), but never drops its local reference.

Add nf_ct_expect_put(exp) before return to balance allocation.

Fixes: 857b46027d ("netfilter: nft_ct: add ct expectations support")
Cc: stable@vger.kernel.org
Signed-off-by: Li Xiasong <lixiasong1@huawei.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2026-06-01 17:39:32 +02:00

..

6lowpan

…

9p

…

802

…

8021q

…

appletalk

…

atm

atm: lec: fix use-after-free in sock_def_readable()

2026-04-11 14:16:18 +02:00

ax25

…

batman-adv

batman-adv: bla: put backbone reference on failed claim hash insert

2026-06-01 17:39:03 +02:00

bluetooth

Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp

2026-06-01 17:39:08 +02:00

bpf

bpf: reject short IPv4/IPv6 inputs in bpf_prog_test_run_skb

2026-06-01 17:39:08 +02:00

bpfilter

…

bridge

bridge: br_nd_send: validate ND option lengths

2026-04-11 14:16:31 +02:00

caif

net: caif: clear client service pointer on teardown

2026-06-01 17:38:45 +02:00

can

can: raw: fix ro->uniq use-after-free in raw_rcv()

2026-06-01 17:38:35 +02:00

ceph

libceph: Fix slab-out-of-bounds access in auth message processing

2026-06-01 17:38:58 +02:00

core

neigh: let neigh_xmit take skb ownership

2026-06-01 17:39:28 +02:00

dcb

…

dccp

…

devlink

…

dns_resolver

…

dsa

net: dsa: clean up FDB, MDB, VLAN entries on unbind

2026-06-01 17:38:40 +02:00

ethernet

…

ethtool

…

hsr

net: hsr: fix VLAN add unwind on slave errors

2026-04-11 14:16:24 +02:00

ieee802154

…

ife

…

ipv4

ipv4: add new arguments to udp_tunnel_dst_lookup()

2026-06-01 17:39:29 +02:00

ipv6

ipv6: rename and move ip6_dst_lookup_tunnel()

2026-06-01 17:39:29 +02:00

iucv

…

kcm

…

key

af_key: validate families in pfkey_send_migrate()

2026-04-11 14:16:05 +02:00

l2tp

l2tp: Drop large packets with UDP encap

2026-06-01 17:38:35 +02:00

l3mdev

…

lapb

…

llc

…

mac80211

wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure

2026-06-01 17:38:40 +02:00

mac802154

…

mctp

mctp: route: hold key->lock in mctp_flow_prepare_output()

2026-03-25 11:03:04 +01:00

mpls

…

mptcp

mptcp: fix scheduling with atomic in timestamp sockopt

2026-06-01 17:39:00 +02:00

ncsi

net: ncsi: fix skb leak in error paths

2026-03-25 11:03:09 +01:00

netfilter

netfilter: nft_ct: fix missing expect put in obj eval

2026-06-01 17:39:32 +02:00

netlabel

…

netlink

…

netrom

…

nfc

NFC: digital: Bounds check NFC-A cascade depth in SDD response handler

2026-06-01 17:38:36 +02:00

nsh

…

openvswitch

openvswitch: cap upcall PID array size and pre-size vport replies

2026-06-01 17:39:24 +02:00

packet

net: fix fanout UAF in packet_release() via NETDEV_UP race

2026-04-11 14:16:07 +02:00

phonet

…

psample

…

qrtr

net: qrtr: ns: Fix use-after-free in driver remove()

2026-06-01 17:38:46 +02:00

rds

net/rds: zero per-item info buffer before handing it to visitors

2026-06-01 17:39:25 +02:00

rfkill

net: rfkill: prevent unlimited numbers of rfkill events from being created

2026-04-18 10:35:57 +02:00

rose

net/rose: fix NULL pointer dereference in rose_transmit_link on reconnect

2026-03-25 11:03:20 +01:00

rxrpc

rxrpc: Fix missing validation of ticket length in non-XDR key preparsing

2026-06-01 17:38:43 +02:00

sched

net/sched: sch_pie: annotate more data-races in pie_dump_stats()

2026-06-01 17:39:31 +02:00

sctp

sctp: discard stale INIT after handshake completion

2026-06-01 17:39:29 +02:00

smc

net/smc: avoid early lgr access in smc_clc_wait_msg

2026-06-01 17:38:47 +02:00

strparser

net: strparser: fix skb_head leak in strp_abort_strp()

2026-06-01 17:38:45 +02:00

sunrpc

sunrpc: fix cache_request leak in cache_release

2026-03-25 11:03:12 +01:00

switchdev

…

tipc

tipc: fix double-free in tipc_buf_append()

2026-06-01 17:39:26 +02:00

tls

net: tls: fix strparser anchor skb leak on offload RX setup failure

2026-06-01 17:39:30 +02:00

unix

bpf, sockmap: Take state lock for af_unix iter

2026-06-01 17:39:18 +02:00

vmw_vsock

vsock/virtio: fix accept queue count leak on transport mismatch

2026-06-01 17:39:04 +02:00

wireless

Revert "wifi: cfg80211: stop NAN and P2P in cfg80211_leave"

2026-06-01 17:38:40 +02:00

x25

net/x25: Fix overflow when accumulating packets

2026-04-11 14:16:24 +02:00

xdp

xsk: tighten UMEM headroom validation to account for tailroom and min frame

2026-06-01 17:38:34 +02:00

xfrm

xfrm: provide message size for XFRM_MSG_MAPPING

2026-06-01 17:38:55 +02:00

compat.c

…

devres.c

…

Kconfig

…

Kconfig.debug

…

Makefile

…

socket.c

…

sysctl_net.c

…