Executive brief
A vulnerability in the Linux kernel's networking subsystem could allow a local user to cause a system crash or potentially execute unauthorized actions. The issue occurs when certain firewall components (netfilter) are removed while network packets are still waiting in a processing queue, leading to the use of invalid memory references. This could impact the stability and security of servers or workstations running affected versions of Linux.
Technical details
A use-after-free or stale reference vulnerability exists in the netfilter nft_ct component of the Linux kernel. Packets enqueued in nfqueue may maintain references to conntrack templates, timeout policies, or helpers; if these objects are removed or the module is unloaded while packets are still pending, the kernel may attempt to access freed memory. An attacker with local access could exploit this to cause a denial of service (system crash) or potentially achieve privilege escalation. The fix involves explicitly dropping enqueued packets during the destruction of nft_ct objects to ensure no stale references remain. Patching is available across multiple stable kernel branches.
Affected products
- Linux Linux kernel 4.19 to 5.10.253, 5.11 to 5.15.203, 5.16 to 6.1.167, 6.2 to 6.6.130, 6.7 to 6.12.78, 6.13 to 6.18.20, 6.19 to 6.19.10, 7.0-rc1 to 7.0-rc4
Timeline
- 2026-03-12: other: Vulnerability fixed in kernel source
- 2026-05-05: disclosed: CVE published
References
- https://git.kernel.org/stable/c/36eae0956f659e48d5366d9b083d9417f3263ddc
- https://git.kernel.org/stable/c/3da0b946835f33bf36b459ead764c61a761e689b
- https://git.kernel.org/stable/c/6802ff8beceb9c4254318e81c1395720438f2cc2
- https://git.kernel.org/stable/c/77da55dee67720e2b8d2db49a53334e6c017ee7b
- https://git.kernel.org/stable/c/8a64e76933672b08bd85b63086f33432070fd729
- https://git.kernel.org/stable/c/ab50302190b303f847c4eba0e31a01a56dec596e
- https://git.kernel.org/stable/c/e68a8db3a0546482b34e9ca5ca886bcf73eb37bb