AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

In the Linux kernel, the following vulnerability has been resolved:

netfilter: x_tables: add and use xtables_unregister_table_exit

Previous change added xtables_unregister_table_pre_exit to detach the
table from the packetpath and to unlink it from the active table list.
In case of rmmod, userspace that is doing set/getsockopt for this table
will not be able to re-instantiate the table:
 1. The larval table has been removed already
 2. existing instantiated table is no longer on the xt pernet table list.

This adds the second stage helper:

unlink the table from the dying list, free the hook ops (if any) and do
the audit notification.  It replaces xt_unregister_table().

https://git.kernel.org/stable/c/8026e5163cca1d1db436c7bfb89ddea8b5e8c2cf

https://git.kernel.org/stable/c/86ee5bc9c0f0e652e19f395675a432de11b75514

https://git.kernel.org/stable/c/b4597d5fd7d2f8cebfffd40dffb5e003cc78964c

[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["include/linux/netfilter/x_tables.h","net/ipv4/netfilter/arp_tables.c","net/ipv4/netfilter/ip_tables.c","net/ipv4/netfilter/iptable_nat.c","net/ipv6/netfilter/ip6_tables.c","net/ipv6/netfilter/ip6table_nat.c","net/netfilter/x_tables.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"fdacd57c79b79a03c7ca88f706ad9fb7b46831c1","lessThan":"86ee5bc9c0f0e652e19f395675a432de11b75514","versionType":"git","status":"affected"},{"version":"fdacd57c79b79a03c7ca88f706ad9fb7b46831c1","lessThan":"8026e5163cca1d1db436c7bfb89ddea8b5e8c2cf","versionType":"git","status":"affected"},{"version":"fdacd57c79b79a03c7ca88f706ad9fb7b46831c1","lessThan":"b4597d5fd7d2f8cebfffd40dffb5e003cc78964c","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["include/linux/netfilter/x_tables.h","net/ipv4/netfilter/arp_tables.c","net/ipv4/netfilter/ip_tables.c","net/ipv4/netfilter/iptable_nat.c","net/ipv6/netfilter/ip6_tables.c","net/ipv6/netfilter/ip6table_nat.c","net/netfilter/x_tables.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.15","status":"affected"},{"version":"0","lessThan":"5.15","versionType":"semver","status":"unaffected"},{"version":"6.18.34","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.0.11","lessThanOrEqual":"7.0.*","versionType":"semver","status":"unaffected"},{"version":"7.1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]