netfilter ebtables TableRemoval Race

Vulnerability analysis

The root cause is a TOCTOU/race condition introduced by commit 87663c39f898 in the ebtables lazy-registration scheme. In the original buggy code, ebt_register_table() would add the table to the per-netns list and release the ebt_mutex before assigning table->ops and calling nf_register_net_hooks(). This created a window where a partially-initialized table struct (with ops not yet assigned) was visible to other threads. Concurrently, ebt_unregister_table_pre_exit() and ebt_unregister_table() used a two-step lookup (__ebt_find_table) that released and re-acquired the mutex between finding and operating on the table, creating a window for use-after-free if the table was freed between the two operations. The fix implements a proper two-stage removal scheme: (1) table->ops is now assigned while still holding ebt_mutex before the table is added to the live list, preventing exposure of partially-filled structs; (2) a new dead_tables list is introduced so that ebt_unregister_table_pre_exit() atomically moves the table from tables to dead_tables (under the mutex) before unregistering hooks, and ebt_unregister_table() then operates only on dead_tables; (3) the unregister order in module exit functions is swapped to call ebt_unregister_template() before unregister_pernet_subsys(). The attack surface requires CAP_NET_ADMIN, which is obtainable by unprivileged users via user namespaces on most Linux distributions, making this reachable from unprivileged local processes.