Executive brief
A vulnerability was identified in the Linux kernel's Netfilter component, which handles network address translation (NAT). Under specific conditions, the system could prematurely release memory while it is still being accessed by tools used to monitor network hooks. This could potentially lead to system instability or crashes when an administrator attempts to audit network security settings.
Technical details
A use-after-free vulnerability exists in the Netfilter NAT subsystem of the Linux kernel. The root cause is the use of kfree() instead of kfree_rcu() when releasing nf_hook_ops structures in nf_nat_register_fn() and related functions. Since the introduction of netfilter hook dumping in version 5.14, userspace can peek into these structures via the nfnl hook dump subsystem. If a hook is unregistered or an error occurs during registration while a dump is in progress, the data path or dump subsystem may access freed memory. An attacker with local privileges could potentially trigger this race condition to cause a kernel oops or system instability. The issue is resolved by deferring memory release using RCU.
Affected products
- Linux Linux 5.14 to 7.1
Timeline
- 2026-04-15: other: Patch authored
- 2026-06-24: disclosed: CVE published