HIGH Public exploit Introduced in 6.4
netfilter Catchall UAF
CVE-2026-23278
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI7.1HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: always walk all pending catchall elements During transaction processing we might have more than one catchall element: 1 live catchall element and 1 pending element that is coming as part of the new batch. If the map holding the catchall elements is also going away, its required to toggle all catchall elements and not just the first viable candidate. Otherwise, we get: WARNING: ./include/net/netfilter/nf_tables.h:1281 at nft_data_release+0xb7/0xe0 [nf_tables], CPU#2: nft/1404 RIP: 0010:nft_data_release+0xb7/0xe0 [nf_tables] [..] __nft_set_elem_destroy+0x106/0x380 [nf_tables] nf_tables_abort_release+0x348/0x8d0 [nf_tables] nf_tables_abort+0xcf2/0x3ac0 [nf_tables] nfnetlink_rcv_batch+0x9c9/0x20e0 [..]
02KernelScan AI Analysis
Risk summary
Local attackers with CAP_NET_ADMIN (obtainable via unprivileged user namespaces on default kernels) can trigger a use-after-free in netfilter's nf_tables catchall element processing during transaction abort. The resulting memory corruption can expose kernel heap contents or object pointers and lead to kernel warnings, memory corruption, or system crashes.
Vulnerability analysis
The vulnerability occurs in netfilter's nf_tables transaction processing where catchall element cleanup functions (nft_map_catchall_deactivate and nft_map_catchall_activate) prematurely exit their loops after processing only the first element. During complex transactions involving map destruction, multiple catchall elements (live and pending) may exist, but only the first is properly toggled. This leaves other elements with dangling references to freed map or chain objects. When the transaction aborts and attempts to release these elements, nft_data_release operates on stale pointers, causing a use-after-free. The attack surface is local netlink access to nf_tables. While CAP_NET_ADMIN is required, this capability is commonly available to unprivileged processes through user namespaces. The fix removes the erroneous break statements to ensure all catchall elements are walked.
Exploit availability
KernelScan found public exploit code for this CVE. Open it in the CVE browser to see what we found, where, and how strong the evidence is — that needs a free account with a confirmed email address.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 4.19 | 4.19.316 | 4.20 | 4830fb44d12f |
| 5.10 | 5.10.188 | 5.11 | de47a88c6b80 |
| 5.15 | 5.15.121 | 5.16 | 77c26b5056d6 |
| 5.4 | 5.4.262 | 5.5 | eb0948fa1329 |
| 6.1 | 6.1.36 | 6.1.177 | c4d4e86fda70 |
| 6.12 | 6.4 | 6.12.78 | — |
| 6.18 | 6.4 | 6.18.19 | — |
| 6.19 | 6.4 | 6.19.9 | — |
| 6.3 | 6.3.10 | 6.4 | 7cb9a23d7ae4 |
| 6.6 | 6.4 | 6.6.144 | — |
| mainline | 6.4 | 7.0 | — |
| cip/6.1 | 6.4 | 6.1.177-cip58 | c4d4e86fda70 |
| cip/6.1-rt | 6.4 | 6.1.182-cip59-rt31 | c4d4e86fda70 |
| cip/6.12 | 6.4 | 6.12.78-cip19 | eb0948fa1329 |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Fixed in 6.12.78-cip19 |
| cip/6.1 | Fixed in 6.1.177-cip58 |
| cip/6.1-rt | Fixed in 6.1.182-cip59-rt31 |
| cip/5.10 | Affected — no CIP fix yet (latest 5.10.271-cip78) |
| cip/5.10-rt | Affected — no CIP fix yet (latest 5.10.268-cip77-rt34) |
| cip/4.19 | Affected — no CIP fix yet (latest 4.19.325-cip136) |
| cip/4.19-rt | Affected — no CIP fix yet (latest 4.19.325-cip136-rt50) |