CVE-2026-23231

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-23231
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: fix use-after-free in nf_tables_addchain() nf_tables_addchain() publishes the chain to table->chains via list_add_tail_rcu() (in nft_chain_add()) before registering hooks. If nf_tables_register_hook() then fails, the error path calls nft_chain_del() (list_del_rcu()) followed by nf_tables_chain_destroy() with no RCU grace period in between. This creates two use-after-free conditions: 1) Control-plane: nf_tables_dump_chains() traverses table->chains under rcu_read_lock(). A concurrent dump can still be walking the chain when the error path frees it. 2) Packet path: for NFPROTO_INET, nf_register_net_hook() briefly installs the IPv4 hook before IPv6 registration fails. Packets entering nft_do_chain() via the transient IPv4 hook can still be dereferencing chain->blob_gen_X when the error path frees the chain. Add synchronize_rcu() between nft_chain_del() and the chain destroy so that all RCU readers -- both dump threads and in-flight packet evaluation -- have finished before the chain is freed.

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/2a6586ecfa4ce1413daaafee250d2590e05f1a33 Patch
https://git.kernel.org/stable/c/2f9a4ffeb763aec822f8ff3d1e82202d27d46d4b Patch
https://git.kernel.org/stable/c/7017745068a9068904e1e7a1b170a5785647cc81 Patch
https://git.kernel.org/stable/c/71e99ee20fc3f662555118cf1159443250647533 Patch
https://git.kernel.org/stable/c/dbd0af8083dd201f07c49110b2ee93710abdff28 Patch
https://git.kernel.org/stable/c/f3fe58ce37926a10115ede527d59b91bcc05400a Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

17 Mar 2026, 21:22

Type Values Removed Values Added
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.8
First Time Linux
Linux linux Kernel
CWE CWE-416
Summary
  • (es) En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta: netfilter: nf_tables: corrige uso después de liberación en nf_tables_addchain() nf_tables_addchain() publica la cadena en table->chains a través de list_add_tail_rcu() (en nft_chain_add()) antes de registrar los ganchos. Si nf_tables_register_hook() falla entonces, la ruta de error llama a nft_chain_del() (list_del_rcu()) seguido de nf_tables_chain_destroy() sin un período de gracia RCU intermedio. Esto crea dos condiciones de uso después de liberación: 1) Plano de control: nf_tables_dump_chains() recorre table->chains bajo rcu_read_lock(). Un volcado concurrente aún puede estar recorriendo la cadena cuando la ruta de error la libera. 2) Ruta de paquetes: para NFPROTO_INET, nf_register_net_hook() instala brevemente el gancho IPv4 antes de que falle el registro de IPv6. Los paquetes que entran en nft_do_chain() a través del gancho IPv4 transitorio aún pueden estar desreferenciando chain->blob_gen_X cuando la ruta de error libera la cadena. Añadir synchronize_rcu() entre nft_chain_del() y la destrucción de la cadena para que todos los lectores RCU -- tanto los hilos de volcado como la evaluación de paquetes en curso -- hayan terminado antes de que la cadena sea liberada.
References () https://git.kernel.org/stable/c/2a6586ecfa4ce1413daaafee250d2590e05f1a33 - () https://git.kernel.org/stable/c/2a6586ecfa4ce1413daaafee250d2590e05f1a33 - Patch
References () https://git.kernel.org/stable/c/2f9a4ffeb763aec822f8ff3d1e82202d27d46d4b - () https://git.kernel.org/stable/c/2f9a4ffeb763aec822f8ff3d1e82202d27d46d4b - Patch
References () https://git.kernel.org/stable/c/7017745068a9068904e1e7a1b170a5785647cc81 - () https://git.kernel.org/stable/c/7017745068a9068904e1e7a1b170a5785647cc81 - Patch
References () https://git.kernel.org/stable/c/71e99ee20fc3f662555118cf1159443250647533 - () https://git.kernel.org/stable/c/71e99ee20fc3f662555118cf1159443250647533 - Patch
References () https://git.kernel.org/stable/c/dbd0af8083dd201f07c49110b2ee93710abdff28 - () https://git.kernel.org/stable/c/dbd0af8083dd201f07c49110b2ee93710abdff28 - Patch
References () https://git.kernel.org/stable/c/f3fe58ce37926a10115ede527d59b91bcc05400a - () https://git.kernel.org/stable/c/f3fe58ce37926a10115ede527d59b91bcc05400a - Patch

04 Mar 2026, 14:16

Type Values Removed Values Added
References
  • () https://git.kernel.org/stable/c/2a6586ecfa4ce1413daaafee250d2590e05f1a33 -
  • () https://git.kernel.org/stable/c/7017745068a9068904e1e7a1b170a5785647cc81 -
  • () https://git.kernel.org/stable/c/f3fe58ce37926a10115ede527d59b91bcc05400a -

04 Mar 2026, 13:15

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-04 13:15

Updated : 2026-03-17 21:22

NVD link : CVE-2026-23231

Mitre link : CVE-2026-23231

CVE.ORG link : CVE-2026-23231

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-416

Use After Free