Executive brief
A vulnerability exists in the Linux kernel's networking subsystem that could allow a local user to crash the system or potentially execute unauthorized code. The issue occurs within the netfilter component, which manages firewall rules and network traffic filtering. If exploited, this could lead to a complete loss of system availability or the compromise of sensitive data handled by the kernel.
Technical details
A use-after-free vulnerability exists in nf_tables_addchain() within the Linux kernel's netfilter subsystem. The function publishes a new chain to the table list before registering hooks; if hook registration subsequently fails, the error path deletes and destroys the chain without an RCU grace period. This creates a race condition where RCU readers (such as concurrent chain dumps or in-flight packet evaluation in the NFPROTO_INET path) may still be accessing the chain's memory after it has been freed. An attacker with local access and the ability to manipulate nf_tables can exploit this to cause a kernel panic or achieve arbitrary code execution. The fix introduces synchronize_rcu() in the error path to ensure all readers have finished before the memory is reclaimed.
Affected products
- Linux Linux Kernel 3.16 to 6.1.165, 6.2 to 6.6.128, 6.7 to 6.12.75, 6.13 to 6.18.14, 6.19 to 6.19.4
Timeline
- 2026-02-17: patched: Initial patch authored by Inseo An
- 2026-03-04: disclosed: CVE published by kernel.org
References
- https://git.kernel.org/stable/c/2a6586ecfa4ce1413daaafee250d2590e05f1a33
- https://git.kernel.org/stable/c/2f9a4ffeb763aec822f8ff3d1e82202d27d46d4b
- https://git.kernel.org/stable/c/7017745068a9068904e1e7a1b170a5785647cc81
- https://git.kernel.org/stable/c/71e99ee20fc3f662555118cf1159443250647533
- https://git.kernel.org/stable/c/dbd0af8083dd201f07c49110b2ee93710abdff28
- https://git.kernel.org/stable/c/f3fe58ce37926a10115ede527d59b91bcc05400a
- https://cert-portal.siemens.com/productcert/html/ssa-253495.html