Executive brief
A vulnerability in the Linux kernel's networking subsystem could allow a local user to cause a system crash or potentially execute unauthorized actions. The issue exists in the component that handles network packet queuing for user-space applications. If exploited, this could lead to a complete loss of system availability or compromise of sensitive data.
Technical details
A use-after-free (UAF) vulnerability exists in the netfilter nfnetlink_queue module due to the use of a global hash table shared among all queues. The root cause is a race condition where 'struct nf_queue_entry' is freed via kfree while a parallel CPU is still traversing the list, leading to a slab-use-after-free in 'nfqnl_recv_verdict'. An attacker with local access could trigger this condition to cause a kernel panic or potentially achieve arbitrary code execution. The fix involves moving the hash table to a per-queue basis and ensuring proper synchronization during cleanup. Patches have been released for multiple stable kernel branches.
Affected products
- Linux Linux Kernel 6.12.75 to 6.12.83, 6.18.14 to 6.18.24, 6.19.4 to 6.19.14
Timeline
- 2026-04-07: other: Vulnerability fixed in upstream source code
- 2026-05-06: disclosed: CVE published
- 2026-05-20: advisory: NVD enrichment and analysis completed