Executive brief
A vulnerability was identified in the Linux kernel's networking subsystem (netfilter) that could lead to system instability or crashes. The issue occurs when network devices are deleted, potentially causing the system to incorrectly handle internal tracking lists. This could allow a local user to disrupt network services or cause a denial-of-service condition on the affected machine.
Technical details
A vulnerability in nf_tables was discovered where the deletion of device hooks improperly modified RCU-protected lists during the transaction preparation phase. Specifically, moving a hook from the basechain/flowtable hook_list to a transaction hook_list violated the expectations of netlink dump path readers accessing the list under RCU protection. This could lead to use-after-free or null pointer dereference scenarios. The fix introduces a new transaction object (nft_trans_hook) and restores the NFT_HOOK_REMOVE flag to safely track deletions without prematurely altering the primary RCU-protected lists. The vulnerability affects Linux kernel versions starting from 5.10.122 and was patched in subsequent stable releases.
Affected products
- Linux Linux 5.10.122 to 5.11, 5.15.47 to 5.16, 5.17.15 to 5.18, 5.18.4 to 5.19, 5.19 and later
Timeline
- 2026-07-19: disclosed
- 2026-07-19: advisory