Executive brief
A vulnerability in the Linux kernel's networking subsystem could allow a local user to cause a memory leak. This occurs within the Netfilter framework, which handles network packet filtering and firewalling. Over time, repeated exploitation could exhaust system memory, potentially leading to a system crash or service outage.
Technical details
A memory leak exists in the nft_dynset component of the Linux kernel's nf_tables subsystem. The vulnerability occurs in the nft_dynset_expr_setup function when multiple stateful expressions are being cloned. If the allocation (GFP_ATOMIC) for a subsequent expression fails, the error path fails to release the memory already allocated for previously cloned expressions. An attacker with local access could potentially trigger this condition to exhaust kernel memory. The issue has been addressed by ensuring nft_set_elem_expr_destroy is called in the error path to properly clean up allocated expressions.
Affected products
- Linux Linux Kernel 5.11.1 to 6.12.78, 6.13 to 6.18.20, 6.19 to 6.19.10
Timeline
- 2026-03-12: other: Initial patch authored
- 2026-03-28: disclosed: CVE published
References
- https://git.kernel.org/stable/c/0548a13b5a145b16e4da0628b5936baf35f51b43
- https://git.kernel.org/stable/c/31641c682db73353e4647e40735c7f2a75ff58ef
- https://git.kernel.org/stable/c/4357dbb1d9c35ca0b4443d71c98a48e6666f7689
- https://git.kernel.org/stable/c/c88a9fd26cee365bec932196f76175772a941cca
- https://git.kernel.org/stable/c/d1354873cbe3b344899c4311ac05897fd83e3f21
- https://git.kernel.org/stable/c/e6661add2d9c6913e1dad97336595e23a2bed195
- https://git.kernel.org/stable/c/eb7bf413e59945df03d4567b73ce464eebe2f4ea