CVE-2026-23392netfilter: nf_tables: release flowtable after rcu grace period on error
Updated under an hour ago ()
Does this affect you?
It affects Linux and 5 other products. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: release flowtable after rcu grace period on error Call synchronize_rcu() after unregistering the hooks from error path, since a hook that already refers to this flowtable can be already registered, exposing this flowtable to packet path and nfnetlink_hook control plane. This error path is rare, it should only happen by reaching the maximum number hooks or by failing to set up to hardware offload, just call synchronize_rcu(). There is a check for already used device hooks by different flowtable that could result in EEXIST at this late stage. The hook parser can be updated to perform this check earlier to this error path really becomes rarely exercised. Uncovered by KASAN reported as use-after-free from nfnetlink_hook path when dumping hooks.
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Modified
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 3b49e2e94e6ebb8b23d0955d9e898254455734f8 before d2632de96ccb066e0131ad1494241b9c281c60b8; from 3b49e2e94e6ebb8b23d0955d9e898254455734f8 before adee3436ccd29f1e514c028899e400cbc6d84065; from 3b49e2e94e6ebb8b23d0955d9e898254455734f8 before 7e3955b282eae20d61c75e499c75eade51c20060; from 3b49e2e94e6ebb8b23d0955d9e898254455734f8 before c8092edb9a11f20f95ccceeb9422b7dd0df337bd; from 3b49e2e94e6ebb8b23d0955d9e898254455734f8 before e78a2dcc7cfb87b64a631441ca7681492b347ef6; from 3b49e2e94e6ebb8b23d0955d9e898254455734f8 before d73f4b53aaaea4c95f245e491aa5eeb8a21874ce | CNA record |
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518_4_pn_dp_mfp (from the name) | from V3.1.6 | CISA ADP |
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518f_4_pn_dp_mfp (from the name) | from V3.1.6 | CISA ADP |
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem siemens:simatic_s7_1500_tm_mfp_gnu_linux_subsystem (from the name) | all versions | CISA ADP |
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP siemens:siplus_s7_1500_cpu_1518_4_pn_dp_mfp (from the name) | from V3.1.6 | CISA ADP |
linux linux_kernel linux:linux_kernel | from 4.16.1 before 6.1.167; from 6.2 before 6.6.130; from 6.7 before 6.12.78; from 6.13 before 6.18.20; from 6.19 before 6.19.10; 4.16; 7.0; 7.0; and 5 more ranges | NVD |
References
- https://git.kernel.org/stable/c/d2632de96ccb066e0131ad1494241b9c281c60b8patch
- https://git.kernel.org/stable/c/adee3436ccd29f1e514c028899e400cbc6d84065patch
- https://git.kernel.org/stable/c/7e3955b282eae20d61c75e499c75eade51c20060patch
- https://git.kernel.org/stable/c/c8092edb9a11f20f95ccceeb9422b7dd0df337bdpatch
- https://git.kernel.org/stable/c/e78a2dcc7cfb87b64a631441ca7681492b347ef6patch
- https://git.kernel.org/stable/c/d73f4b53aaaea4c95f245e491aa5eeb8a21874cepatch
- https://cert-portal.siemens.com/productcert/html/ssa-019113.html
- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
- https://cert-portal.siemens.com/productcert/html/ssa-457936.html
- https://cert-portal.siemens.com/productcert/html/ssa-784472.html
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.