HIGH Public exploit Introduced in 3.16
netfilter NFTables Chain UAF
CVE-2026-23231
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI7.0HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: fix use-after-free in nf_tables_addchain() nf_tables_addchain() publishes the chain to table->chains via list_add_tail_rcu() (in nft_chain_add()) before registering hooks. If nf_tables_register_hook() then fails, the error path calls nft_chain_del() (list_del_rcu()) followed by nf_tables_chain_destroy() with no RCU grace period in between. This creates two use-after-free conditions: 1) Control-plane: nf_tables_dump_chains() traverses table->chains under rcu_read_lock(). A concurrent dump can still be walking the chain when the error path frees it. 2) Packet path: for NFPROTO_INET, nf_register_net_hook() briefly installs the IPv4 hook before IPv6 registration fails. Packets entering nft_do_chain() via the transient IPv4 hook can still be dereferencing chain->blob_gen_X when the error path frees the chain. Add synchronize_rcu() between nft_chain_del() and the chain destroy so that all RCU readers -- both dump threads and in-flight packet evaluation -- have finished before the chain is freed.
02KernelScan AI Analysis
Risk summary
Local attackers with CAP_NET_ADMIN can trigger a use-after-free in netfilter's nf_tables chain management during error-path cleanup, potentially leading to kernel memory corruption and privilege escalation. The vulnerability affects systems where untrusted code can obtain network administration capabilities through user namespaces or unprivileged eBPF.
Vulnerability analysis
The root cause is a missing RCU grace period in nf_tables_addchain()'s error path. When hook registration fails after a chain is published to table->chains via list_add_tail_rcu(), the error path immediately calls nft_chain_del() followed by nf_tables_chain_destroy() without synchronize_rcu(). This creates a race where RCU readers—both control-plane dump operations (nf_tables_dump_chains()) and packet-path evaluation (transient IPv4 hook for NFPROTO_INET before IPv6 registration fails)—can still access the chain structure after it is freed. The fix adds synchronize_rcu() between chain removal and destruction to ensure all RCU readers complete before the memory is freed. Exploitation requires winning a race with an RCU reader and is reachable locally via netlink by any unprivileged actor that can acquire CAP_NET_ADMIN through user namespaces or unprivileged eBPF.
Exploit availability
KernelScan found public exploit code for this CVE. Open it in the CVE browser to see what we found, where, and how strong the evidence is — that needs a free account with a confirmed email address.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.1 | 3.16 | 6.1.165 | 2a6586ecfa4c |
| 6.12 | 3.16 | 6.12.75 | f3fe58ce3792 |
| 6.18 | 3.16 | 6.18.14 | dbd0af8083dd |
| 6.19 | 3.16 | 6.19.4 | 2f9a4ffeb763 |
| 6.6 | 3.16 | 6.6.128 | 7017745068a9 |
| mainline | 3.16 | 7.0 | 71e99ee20fc3 |
| cip/6.1 | 3.16 | 6.1.167-cip53 | 2a6586ecfa4c |
| cip/6.1-rt | 3.16 | 6.1.167-cip53-rt29 | 2a6586ecfa4c |
| cip/6.12 | 3.16 | 6.12.76-cip18 | f3fe58ce3792 |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Fixed in 6.12.76-cip18 |
| cip/6.1 | Fixed in 6.1.167-cip53 |
| cip/6.1-rt | Fixed in 6.1.167-cip53-rt29 |
| cip/5.10 | Affected — no CIP fix yet (latest 5.10.271-cip78) |
| cip/5.10-rt | Affected — no CIP fix yet (latest 5.10.268-cip77-rt34) |
| cip/4.19 | Affected — no CIP fix yet (latest 4.19.325-cip136) |
| cip/4.19-rt | Affected — no CIP fix yet (latest 4.19.325-cip136-rt50) |
| cip/4.4 | Affected — no CIP fix yet (latest 4.4.302-cip115) |
| cip/4.4-rt | Affected — no CIP fix yet (latest 4.4.302-cip115-rt63) |