Junglewise Threat Intelligence

CVE-2026-23458: Linux Kernel Netfilter use-after-free in ctnetlink_dump_exp_ct

CVE-2026-23458 · Severity: high · CVSS 7.8 · Published 2026-04-03

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability was identified in the Linux kernel's Netfilter subsystem, which manages network traffic filtering and connection tracking. A local attacker could exploit this flaw to cause a system crash or potentially execute unauthorized code by triggering a memory error during specific network data requests. This could lead to a complete loss of system availability or unauthorized access to sensitive kernel data.

Technical details

A use-after-free vulnerability exists in the ctnetlink_dump_exp_ct() function within the Netfilter subsystem of the Linux kernel. The issue stems from the netlink_dump_control structure lacking .start and .done callbacks to properly manage conntrack reference counts across multiple rounds of a netlink dump. When a dump spans multiple rounds, a second recvmsg() call can trigger a callback that dereferences a conntrack pointer that has already been freed, specifically via nfct_help(ct). Attackers with local access can exploit this to trigger a kernel panic or achieve arbitrary code execution. Patches have been released across various stable kernel branches to implement proper reference counting via .start and .done callbacks.

Affected products

  • Linux Linux Kernel 3.10 to 5.10.253, 5.11 to 5.15.203, 5.16 to 6.1.167, 6.2 to 6.6.130, 6.7 to 6.12.78, 6.13 to 6.18.20, 6.19 to 6.19.10, 7.0-rc1 to 7.0-rc4

Timeline

  • 2026-03-08: other: Vulnerability fixed in upstream code by Hyunwoo Kim
  • 2026-04-03: advisory: CVE-2026-23458 published
  • 2026-04-18: patched: Patches integrated into multiple stable kernel branches

References