HIGH Public exploit Introduced in 4.10
netfilter NFTables Race
CVE-2026-23272
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI7.0HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: unconditionally bump set->nelems before insertion In case that the set is full, a new element gets published then removed without waiting for the RCU grace period, while RCU reader can be walking over it already. To address this issue, add the element transaction even if set is full, but toggle the set_full flag to report -ENFILE so the abort path safely unwinds the set to its previous state. As for element updates, decrement set->nelems to restore it. A simpler fix is to call synchronize_rcu() in the error path. However, with a large batch adding elements to already maxed-out set, this could cause noticeable slowdown of such batches.
02KernelScan AI Analysis
Risk summary
A race condition in netfilter nf_tables allows RCU readers to access set elements being removed without proper synchronization. Local attackers with network administration privileges can potentially achieve kernel memory corruption through use-after-free access, leading to privilege escalation or system crash.
Vulnerability analysis
The vulnerability occurs when adding elements to a full nf_tables set. The original code published new elements to RCU readers before checking set capacity, then immediately removed them without waiting for RCU grace periods. This created a race window where RCU readers could access freed memory. The fix ensures proper transaction handling by unconditionally bumping nelems before insertion and using the abort path for safe cleanup with RCU synchronization. Attack surface is local netlink sockets requiring CAP_NET_ADMIN, but this can be obtained via user namespaces on systems without unprivileged namespace restrictions.
Exploit availability
KernelScan found public exploit code for this CVE. Open it in the CVE browser to see what we found, where, and how strong the evidence is — that needs a free account with a confirmed email address.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 4.9 | 4.9.33 | 4.10 | 25fcaef79489 |
| 6.1 | 4.10 | 6.1.177 | e3ccb11fc824 |
| 6.12 | 4.10 | 6.12.91 | 6826131c7674 |
| 6.18 | 4.10 | 6.18.17 | ccb8c8f3c112 |
| 6.19 | 4.10 | 6.19.7 | def602e498a4 |
| 6.6 | 4.10 | 6.6.141 | 86bc4b1a0f67 |
| mainline | 4.10 | 7.0 | — |
| cip/6.1 | 4.10 | 6.1.177-cip58 | 25fcaef79489 |
| cip/6.1-rt | 4.10 | 6.1.182-cip59-rt31 | 25fcaef79489 |
| cip/6.12 | 4.10 | 6.12.92-cip25 | 86bc4b1a0f67 |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Fixed in 6.12.92-cip25 |
| cip/6.1 | Fixed in 6.1.177-cip58 |
| cip/6.1-rt | Fixed in 6.1.182-cip59-rt31 |
| cip/5.10 | Affected — no CIP fix yet (latest 5.10.271-cip78) |
| cip/5.10-rt | Affected — no CIP fix yet (latest 5.10.268-cip77-rt34) |
| cip/4.19 | Affected — no CIP fix yet (latest 4.19.325-cip136) |
| cip/4.19-rt | Affected — no CIP fix yet (latest 4.19.325-cip136-rt50) |