Executive brief
The Linux kernel's netfilter packet filtering subsystem contains a use-after-free vulnerability in its netfilter table notification mechanism. When a packet traverses a quota rule that triggers a notification, it can race with the kernel's transaction commit process, causing the kernel to write to freed memory. An attacker able to send network traffic through a quota-controlled rule while netlink transactions are being processed could crash the kernel or potentially execute code.
Technical details
The vulnerability is a use-after-free race condition in __nft_obj_notify() within net/netfilter/nf_tables_api.c. The root cause is that nft_obj_notify() is callable from the packet processing path (via nft_quota_obj_eval()) without holding commit_mutex, but it queues notifications to a shared nft_net->notify_list that is being drained unsynchronized in nft_commit_notify(). When a packet triggers a quota notification while another CPU is committing a netlink transaction, an unlocked list_add_tail() races against list_del() + kfree_skb() on an sk_buff, causing a write to freed memory. The attack requires the ability to send packets through a quota-controlled chain while netlink transactions are pending. The fix splits notification construction from queueing, allowing the packet path to send notifications immediately without queuing to the unprotected list.
Affected products
- Linux Linux kernel v7.2-rc4 and v7.2-rc6; fix applied after commit 67cc570edaa0
Timeline
- 2026-09-04: disclosed