CVE-2024-26835: netfilter: nf_tables: set dormant flag on hook register failure

CVE-2024-26835: netfilter: nf_tables: set dormant flag on hook register failure

[Greg Kroah-Hartman]

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_tables: set dormant flag on hook register failure

We need to set the dormant flag again if we fail to register
the hooks.

During memory pressure hook registration can fail and we end up
with a table marked as active but no registered hooks.

On table/base chain deletion, nf_tables will attempt to unregister
the hook again which yields a warn splat from the nftables core.

The Linux kernel CVE team has assigned CVE-2024-26835 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.4.262 with commit e10f661adc55 and fixed in 5.4.270 with commit ae4360cbd385
	Issue introduced in 5.10.202 with commit d9c4da8cb74e and fixed in 5.10.211 with commit 31ea574aeca1
	Issue introduced in 5.13 with commit 179d9ba5559a and fixed in 5.15.150 with commit 664264a5c55b
	Issue introduced in 5.13 with commit 179d9ba5559a and fixed in 6.1.80 with commit 0c9302a6da26
	Issue introduced in 5.13 with commit 179d9ba5559a and fixed in 6.6.19 with commit f2135bbf1494
	Issue introduced in 5.13 with commit 179d9ba5559a and fixed in 6.7.7 with commit 6f2496366426
	Issue introduced in 5.13 with commit 179d9ba5559a and fixed in 6.8 with commit bccebf647017

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2024-26835
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/netfilter/nf_tables_api.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/ae4360cbd385f0d7a8a86d5723e50448cc6318f3
	https://git.kernel.org/stable/c/31ea574aeca1aa488e18716459bde057217637af
	https://git.kernel.org/stable/c/664264a5c55bf97a9c571c557d477b75416199be
	https://git.kernel.org/stable/c/0c9302a6da262e6ab6a6c1d30f04a6130ed97376
	https://git.kernel.org/stable/c/f2135bbf14949687e96cabb13d8a91ae3deb9069
	https://git.kernel.org/stable/c/6f2496366426cec18ba53f1c7f6c3ac307ca6a95
	https://git.kernel.org/stable/c/bccebf64701735533c8db37773eeacc6566cc8ec