Executive brief
The Linux kernel contains a use-after-free vulnerability in network namespace initialization that occurs when ops_init() fails. When this failure happens, memory is freed but a pointer remains in use, potentially allowing an attacker to read or corrupt kernel memory and crash the system or escalate privileges on affected systems.
Technical details
This is a use-after-free vulnerability in the Linux kernel's netfilter subsystem. The root cause is in ops_init() within net namespace setup: when initializing per-namespace data, memory is allocated and assigned to net->gen->ptr, but if ops->init() fails, the data is freed without clearing the pointer. Subsequently, when nfqnl_nf_hook_drop() is called during namespace cleanup, it dereferences the invalid pointer through nfnl_queue_pernet(net), causing a KASAN-detected use-after-free. The vulnerability is triggered via unshare() system call when creating new network namespaces, and no special privileges are required beyond the ability to create namespaces. An attacker can achieve kernel memory disclosure, corruption, or denial of service. Fixes are available in patched kernel versions.
Affected products
- Linux Linux kernel
Timeline
- 2025-12-24: disclosed