Executive brief
A vulnerability was identified in the Linux kernel's networking subsystem (netfilter) that could allow a local user to cause system instability or gain unauthorized privileges. The issue stems from how the system handles network device registrations, potentially leading to duplicate entries that confuse the kernel's internal logic. This could impact the availability of the server or the integrity of data processed by the firewall.
Technical details
A vulnerability exists in the Linux kernel netfilter subsystem (nf_tables) due to improper handling of NETDEV_REGISTER notifications. When creating a hook, nft_netdev_hook_alloc() may have already added a device; however, the notification handler failed to check for existing registrations properly, leading to duplicate device entries in netdev hooks. A local attacker with low privileges can exploit this flaw to trigger kernel memory corruption or logic errors. The fix involves modifying nf_tables_api.c and nft_chain_filter.c to ensure registration is skipped if the operation already exists, regardless of whether a name change occurred. Patches have been released for various stable kernel branches.
Affected products
- Linux Linux Kernel 6.16 to 6.18.19, 6.19 to 6.19.9, 7.0-rc1 to 7.0-rc3
Timeline
- 2026-03-05: other: Initial patch authored
- 2026-05-08: disclosed: CVE published
- 2026-05-20: advisory: NVD initial analysis completed