CVE-2021-47452

What it actually does

Race condition in nf_tables netdev hook handling allows netns removal events to trigger duplicate basechain unregister attempts after .pre_exit has already released the hook, producing a WARN at net/netfilter/core.c:468.

Why it matters to the business

Harmless kernel warnings during network namespace teardown on Linux systems; may complicate debugging or logging in containerized or multi-tenant environments but carries no direct operational outage or data-loss risk.

How an attack unfolds

An attacker with local unprivileged access creates a new network namespace, adds a bridge device, registers an nftables ingress chain on that device, then removes the namespace; the resulting netdev UNREGISTER event races with the pre_exit hook removal and hits the double-unregister path.

How to fix it

Upgrade the Linux kernel to commit d5226fa6dbae0569ee43ecfc08bdcd6770fc4755 or later; rebuild and reboot affected systems; no configuration workaround exists.

How to confirm the fix worked

Confirm the running kernel contains commit d5226fa6dbae0569ee43ecfc08bdcd6770fc4755 via git describe or uname -r against a patched build; reproduce the original reproducer and verify absence of the WARN.

Typical attack path

1. unshare -n to enter new network namespace
2. ip link add br0 type bridge
3. nft add table netdev t; nft add chain netdev t ingress { type filter hook ingress device "br0" priority 0; policy drop; }
4. exit or delete the namespace to trigger netns device exit hooks

How to detect it

Search kernel logs (dmesg, journalctl -k) for the exact WARN string and stack trace referencing nft_netdev_unregister_hooks and __nft_release_basechain; correlate with nft and ip commands creating netdev hooks inside short-lived namespaces.

• WARNING: CPU:.* at net/netfilter/core.c:468
• nft_netdev_unregister_hooks net/netfilter/nf_tables_api.c:230
• __nft_release_basechain+0x138/0x640
• nf_tables_netdev_event+0x521/0x8a0

What your security team should do

• Patch all Linux kernels to the fixed commit within normal maintenance windows
• Add kernel WARN monitoring for net/netfilter/core.c:468 to existing log aggregation
• Review nftables netdev hook usage in container runtimes for unnecessary namespace churn