CVE-2026-23231: netfilter: nf_tables: fix use-after-free in nf_tables_addchain()
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nftables: fix use-after-free in nftablesaddchain()
nftablesaddchain() publishes the chain to table->chains via listaddtailrcu() (in nftchainadd()) before registering hooks. If nftablesregisterhook() then fails, the error path calls nftchaindel() (listdelrcu()) followed by nftableschaindestroy() with no RCU grace period in between.
This creates two use-after-free conditions:
1) Control-plane: nftablesdumpchains() traverses table->chains under rcureadlock(). A concurrent dump can still be walking the chain when the error path frees it.
2) Packet path: for NFPROTOINET, nfregisternethook() briefly installs the IPv4 hook before IPv6 registration fails. Packets entering nftdochain() via the transient IPv4 hook can still be dereferencing chain->blobgenX when the error path frees the chain.
Add synchronizercu() between nftchaindel() and the chain destroy so that all RCU readers -- both dump threads and in-flight packet evaluation -- have finished before the chain is freed.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.170-3Fixed in 6.1.172-1Fixed in 6.12.86-1Fixed in 6.12.88-1Fixed in 7.0.7-1 - Upgrade
Upgrade
debian/linux-6.1to a version that resolves this vulnerability.Fixed in 6.1.172-1~deb11u1 - Compensating control
In kernel code, add synchronize_rcu() between nft_chain_del() (list_del_rcu()) and the chain destroy (nf_tables_chain_destroy()) so all RCU readers (dump threads and in-flight packet evaluation) finish before the chain is freed.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-23231?
CVE-2026-23231 is classified as a high severity vulnerability due to the potential for use-after-free exploits in the Linux kernel.
How do I fix CVE-2026-23231?
To fix CVE-2026-23231, update the Linux kernel to the latest patched version provided by your distribution.
What systems are affected by CVE-2026-23231?
CVE-2026-23231 affects systems running vulnerable versions of the Linux kernel with netfilter's nf_tables feature.
What are the risks associated with CVE-2026-23231?
The risks associated with CVE-2026-23231 include potential remote code execution or system crashes due to the use-after-free vulnerability.
How can I determine if my system is vulnerable to CVE-2026-23231?
You can determine if your system is vulnerable to CVE-2026-23231 by checking the kernel version and ensuring it has been updated to the latest secure release.