CVE-2026-23399: nf_tables: nft_dynset: fix possible stateful expression memleak in error path
In the Linux kernel, the following vulnerability has been resolved:
nftables: nftdynset: fix possible stateful expression memleak in error path
If cloning the second stateful expression in the element via GFPATOMIC fails, then the first stateful expression remains in place without being released.
unreferenced object (percpu) 0x607b97e9cab8 (size 16): comm "softirq", pid 0, jiffies 4294931867 hex dump (first 16 bytes on cpu 3): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 backtrace (crc 0): pcpuallocnoprof+0x453/0xd80 nftcounterclone+0x9c/0x190 [nftables] nftexprclone+0x8f/0x1b0 [nftables] nftdynsetnew+0x2cb/0x5f0 [nftables] nftrhashupdate+0x236/0x11c0 [nftables] nftdynseteval+0x11f/0x670 [nftables] nftdochain+0x253/0x1700 [nftables] nftdochainipv4+0x18d/0x270 [nftables] nfhookslow+0xaa/0x1e0 iplocaldeliver+0x209/0x330
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-23399?
CVE-2026-23399 has a high severity rating due to its potential for causing a memory leak in the Linux kernel.
How do I fix CVE-2026-23399?
To fix CVE-2026-23399, you should update to the latest version of the Linux kernel that includes the patch for this vulnerability.
What are the potential impacts of CVE-2026-23399?
The potential impacts of CVE-2026-23399 include resource leaks which can lead to degradation of system performance or crashes.
Who is affected by CVE-2026-23399?
CVE-2026-23399 affects users of the Linux kernel that utilize stateful expressions in nf_tables.
When was CVE-2026-23399 reported?
CVE-2026-23399 was reported as part of ongoing security evaluations in the Linux kernel as of its disclosure date.