Executive brief
A vulnerability in the Linux kernel's networking subsystem could allow a local user to cause a system crash. The issue occurs when the system is managing network filtering rules (nftables) while simultaneously trying to view those rules. This race condition can lead to memory corruption and a subsequent denial of service.
Technical details
A race condition exists in the nf_tables component of the Linux kernel due to improper RCU (Read-Copy-Update) list handling. Specifically, the functions nft_netdev_unregister_hooks and __nft_unregister_flowtable_net_hooks used standard list_del() instead of list_del_rcu() while the list could be concurrently traversed by netlink dumpers. This mismatch can lead to use-after-free or null pointer dereference scenarios during concurrent operations. The fix introduces a consistent helper that utilizes list_del_rcu() to ensure safe concurrent access. This is primarily a local denial-of-service vulnerability.
Affected products
- Linux Linux Kernel All versions prior to the June 2026 patches
Timeline
- 2026-04-16: other: Patch authored by Florian Westphal
- 2026-06-09: disclosed: CVE published by kernel.org