CVE-2023-54200netfilter: nf_tables: always release netdev hooks from notifier
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: always release netdev hooks from notifier This reverts "netfilter: nf_tables: skip netdev events generated on netns removal". The problem is that when a veth device is released, the veth release callback will also queue the peer netns device for removal. Its possible that the peer netns is also slated for removal. In this case, the device memory is already released before the pre_exit hook of the peer netns runs: BUG: KASAN: slab-use-after-free in nf_hook_entry_head+0x1b8/0x1d0 Read of size 8 at addr ffff88812c0124f0 by task kworker/u8:1/45 Workqueue: netns cleanup_net Call Trace: nf_hook_entry_head+0x1b8/0x1d0 __nf_unregister_net_hook+0x76/0x510 nft_netdev_unregister_hooks+0xa0/0x220 __nft_release_hook+0x184/0x490 nf_tables_pre_exit_net+0x12f/0x1b0 .. Order is: 1. First netns is released, veth_dellink() queues peer netns device for removal 2. peer netns is queued for removal 3. peer netns device is released, unreg event is triggered 4. unreg event is ignored because netns is going down 5. pre_exit hook calls nft_netdev_unregister_hooks but device memory might be free'd already.
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Deferred
- Record last updated
- Oct 15, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | 68a3765c659f809dcaac20030853a054646eb739 builds before 8d56f00c61f67b450fbbdcb874855e60ad92c560; 68a3765c659f809dcaac20030853a054646eb739 builds before 30e4b13b1bfbdf3bf3b27036d8209ea1b9f0d880; from 68a3765c659f809dcaac20030853a054646eb739 before 94032527efbac13be702c76afb9d872c0cca7a43; from 68a3765c659f809dcaac20030853a054646eb739 before dc1c9fd4a8bbe1e06add9053010b652449bfe411; 90c7c58aa2bd02c65a4c63b7dfe0b16eab12cf9f; from 5.14.15 before 5.15 | CNA record |
References
- https://git.kernel.org/stable/c/8d56f00c61f67b450fbbdcb874855e60ad92c560
- https://git.kernel.org/stable/c/30e4b13b1bfbdf3bf3b27036d8209ea1b9f0d880
- https://git.kernel.org/stable/c/94032527efbac13be702c76afb9d872c0cca7a43
- https://git.kernel.org/stable/c/dc1c9fd4a8bbe1e06add9053010b652449bfe411
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.