Junglewise Threat Intelligence

CVE-2026-23351: Linux Kernel use-after-free in netfilter nft_set_pipapo

CVE-2026-23351 · Severity: high · CVSS 7.8 · Published 2026-03-25

Technologies: Linux Kernel, Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP. Vendors: Linux, Siemens.

Executive brief

A vulnerability exists in the Linux kernel's networking subsystem (Netfilter) that can lead to system crashes or unauthorized data access. When the system attempts to clean up a large number of expired firewall rules, it may incorrectly access memory that has already been freed or cause the system to become unresponsive. This could allow a local attacker to cause a denial of service or potentially escalate their privileges on the affected system.

Technical details

A use-after-free vulnerability was identified in the nft_set_pipapo set type within the Linux kernel's netfilter subsystem. The root cause is an improper garbage collection (GC) mechanism where expired elements were queued for freeing before pointers were swapped, leaving them exposed to packet paths and userspace dumpers. Under high load of expired elements, the commit-time GC could run in a non-preemptible context, leading to RCU stalls and soft lockups. An attacker with local access can exploit this to cause a denial of service or achieve arbitrary code execution. The fix involves splitting the GC process into distinct unlink and reclaim phases to ensure elements are no longer reachable before they are freed.

Affected products

  • Linux Linux Kernel Fixed in various stable branches including 6.x and 5.x via specific patches
  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5, V3.1.6

Timeline

  • 2026-03-03: other: Patch authored
  • 2026-03-25: patched: Patch committed to stable tree
  • 2026-03-25: advisory: CVE published

References

Related threats