CVE-2026-74565netfilter: nf_tables: make nft_object rhltable per table
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: make nft_object rhltable per table The nft_object rhltable is global, this allows for accessing objects that are being dismangled from lookup path by other existing netns. Given the nft_obj_destroy() releases the object inmediately, this might lead to use-after-free of these objects that are being released. Make the existing rhltable per table to address this issue to deal with with the nft_rcv_nl_event() path too. Update nft_obj_lookup() to take the table as non-const, otherwise, compiler complains when passing the objname_ht to rhltable_lookup().
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | 4d44175aa5bb5f68772b1eb0306554812294ca52 builds before 4b549d32d34ee765527e63726bb1af984876e776; from 4d44175aa5bb5f68772b1eb0306554812294ca52 before 523c881661dde67efb44fce38c8eed50a72a57c1; from 4d44175aa5bb5f68772b1eb0306554812294ca52 before 1948e4f85b855618b5b9a27265f98d816f4cb7cb; from 4d44175aa5bb5f68772b1eb0306554812294ca52 before 63ba12b664a2cd3220ed43e22c717715f4cc2ae8; from 4d44175aa5bb5f68772b1eb0306554812294ca52 before 7d4789b58761d9d48d9b5f5e7e0a510c3bbfb3af; from 4d44175aa5bb5f68772b1eb0306554812294ca52 before f4f699790590bd0896c48a71e9232a65198f92f0 | CNA record |
References
- https://git.kernel.org/stable/c/4b549d32d34ee765527e63726bb1af984876e776
- https://git.kernel.org/stable/c/523c881661dde67efb44fce38c8eed50a72a57c1
- https://git.kernel.org/stable/c/1948e4f85b855618b5b9a27265f98d816f4cb7cb
- https://git.kernel.org/stable/c/63ba12b664a2cd3220ed43e22c717715f4cc2ae8
- https://git.kernel.org/stable/c/7d4789b58761d9d48d9b5f5e7e0a510c3bbfb3af
- https://git.kernel.org/stable/c/f4f699790590bd0896c48a71e9232a65198f92f0
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.