When two xt_hashlimit rules share the same table name, htable_find_get() matches on name+family only, ignoring mode/revision. If Rule A creates the table without XT_HASHLIMIT_RATE_MATCH in its mode, rateinfo_init() takes the default branch and only initializes rateinfo.credit, rateinfo.credit_cap, and rateinfo.cost (union offsets 0-23). The rateinfo union is 32 bytes; rateinfo.burst sits at union offset 24 and is never written by the default branch. Since dsthash_alloc_init() uses kmem_cache_alloc() without zeroing, burst contains stale slab data. If Rule B shares the same table but has XT_HASHLIMIT_RATE_MATCH set in its own cfg->mode, hashlimit_mt_common() reads dh->rateinfo.burst, which is uninitialized. Fix by zeroing the rateinfo union immediately after allocation. Signed-off-by: Talha Berk Arslan --- net/netfilter/xt_hashlimit.c | 1 + 1 file changed, 1 insertion(+) diff --git a/net/netfilter/xt_hashlimit.c b/net/netfilter/xt_hashlimit.c index 2704b4b60..8943ed608 100644 --- a/net/netfilter/xt_hashlimit.c +++ b/net/netfilter/xt_hashlimit.c @@ -244,6 +244,7 @@ dsthash_alloc_init(struct xt_hashlimit_htable *ht, } else ent = kmem_cache_alloc(hashlimit_cachep, GFP_ATOMIC); if (ent) { + memset(&ent->rateinfo, 0, sizeof(ent->rateinfo)); memcpy(&ent->dst, dst, sizeof(ent->dst)); spin_lock_init(&ent->lock); -- 2.54.0.windows.1