CVE-2026-23412: netfilter: bpf: defer hook memory release until rcu readers are done
In the Linux kernel, the following vulnerability has been resolved:
netfilter: bpf: defer hook memory release until rcu readers are done
Yiming Qian reports UaF when concurrent process is dumping hooks via nfnetlinkhooks:
BUG: KASAN: slab-use-after-free in nfnlhookdumpone.isra.0+0xe71/0x10f0 Read of size 8 at addr ffff888003edbf88 by task poc/79 Call Trace: <TASK> nfnlhookdumpone.isra.0+0xe71/0x10f0 netlinkdump+0x554/0x12b0 nfnlhookget+0x176/0x230 [..]
Defer release until after concurrent readers have completed.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1
Event History
Frequently Asked Questions
What activity is involved in triggering the issue?
The reported use-after-free occurs when a process is concurrently dumping hooks through nfnetlink_hooks while hook memory is being released. The affected read is reported in nfnl_hook_dump_one during a netlink dump.
How might an affected system identify this condition?
The report shows a KASAN slab-use-after-free, with a read in nfnl_hook_dump_one.isra.0. The stack trace includes netlink_dump and nfnl_hook_get.
What does the fix change?
The fix defers release of hook memory until concurrent RCU readers have completed, preventing hook-dump readers from accessing freed memory.