netfilter: nf_tables: release flowtable after rcu grace period on error
Affects Linux kernel releases from 4.16.0 onward in the listed branches, but only on a rare flowtable error path. Fixed in 6.1.167, 6.6.130, 6.12.78, 6.18.20 and 6.19.10.
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Fix
- Fixed in 6.1.167, 6.6.130, 6.12.78, 6.18.20, 6.19.10
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: total
Summary
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: release flowtable after rcu grace period on error Call synchronize_rcu() after unregistering the hooks from error path, since a hook that already refers to this flowtable can be already registered, exposing this flowtable to packet path and nfnetlink_hook control plane. This error path is rare, it should only happen by reaching the maximum number hooks or by failing to set up to hardware offload, just call synchronize_rcu(). There is a check for already used device hooks by different flowtable that could result in EEXIST at this late stage. The hook parser can be updated to perform this check earlier to this error path really becomes rarely exercised. Uncovered by KASAN reported as use-after-free from nfnetlink_hook path when dumping hooks.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: total
- Record last updated
Affected versions
- Linux Linux
Version range not reported
- Linux Linux
4.16
- KernelLinux
From 4.16.0 · fixed in 6.1.167; From 6.2.0 · fixed in 6.6.130; From 6.7.0 · fixed in 6.12.78; From 6.13.0 · fixed in 6.18.20; From 6.19.0 · fixed in 6.19.10
References 8
git.kernel.org
- stable/c/29538fb3f412f3ce5ad9f97fe7fd84952dacd3af
- stable/c/ec0f801e5ce0162fc4fea95607c716b264d283fb
- stable/c/d2632de96ccb066e0131ad1494241b9c281c60b8
- stable/c/adee3436ccd29f1e514c028899e400cbc6d84065
- stable/c/7e3955b282eae20d61c75e499c75eade51c20060
- stable/c/c8092edb9a11f20f95ccceeb9422b7dd0df337bd
- stable/c/e78a2dcc7cfb87b64a631441ca7681492b347ef6
- stable/c/d73f4b53aaaea4c95f245e491aa5eeb8a21874ce
Questions about CVE-2026-23392
What does this mean?
The netfilter nf_tables flowtable is released before the RCU grace period when an error occurs during setup. The advisory reports a use-after-free in the nfnetlink_hook path when hooks are dumped, found by KASAN.Source: git.kernel.org
Am I affected, and how do I check?
Kernels from 4.16.0 up to the fixed release for each branch are in scope, including 6.2.0 to before 6.6.130, 6.7.0 to before 6.12.78, and 6.13.0 to before 6.18.20. The bug is reached only on the flowtable error path, such as hitting the maximum number of hooks or failing to set up hardware offload. Check the running version with uname -r and compare it with these ranges.Source: git.kernel.org
What should I do about it?
Upgrade to the fixed release for the kernel branch in use: 6.1.167, 6.6.130, 6.12.78, 6.18.20, or 6.19.10.Source: git.kernel.org
Is it being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data