UBUNTU-CVE-2026-23231: Use After Free

Q: Who is exposed to this issue?

Systems using the listed Ubuntu Linux kernel packages are exposed when nf_tables chain creation reaches a hook-registration failure path. The affected code can expose both concurrent nftables chain-dump operations and in-flight packet processing.

Q: What conditions are required to trigger the use-after-free?

An attacker or local user needs privileges sufficient to add an nf_tables chain and cause hook registration to fail. Exploitation also requires a concurrent RCU reader, either a chain dump or packet evaluation through a transient IPv4 hook during failed IPv6 hook registration for NFPROTO_INET.

Q: Are packet-processing paths affected, or only nftables management operations?

Both are affected. A concurrent nf_tables chain dump can retain a reference after the chain is removed, and packets can enter nft_do_chain() through a temporarily installed IPv4 hook while the failed chain is being freed.

Q: How can I determine whether a system has the fix?

The fix adds synchronize_rcu() after nft_chain_del() and before chain destruction in the nf_tables_addchain() error path. Verify that the installed kernel includes upstream commit 71e99ee20fc3f662555118cf1159443250647533 or Ubuntu’s corresponding update.

Published Mar 4, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: fix use-after-free in nftablesaddchain() nftablesaddchain() publishes the chain to table->chains via listaddtailrcu() (in nftchainadd()) before registering hooks. If nftablesregisterhook() then fails, the error path calls nftchaindel() (listdelrcu()) followed by nftableschaindestroy() with no RCU grace period in between. This creates two use-after-free conditions: 1) Control-plane: nftablesdumpchains() traverses table->chains under rcureadlock(). A concurrent dump can still be walking the chain when the error path frees it. 2) Packet path: for NFPROTOINET, nfregisternethook() briefly installs the IPv4 hook before IPv6 registration fails. Packets entering nftdochain() via the transient IPv4 hook can still be dereferencing chain->blobgenX when the error path frees the chain. Add synchronizercu() between nftchaindel() and the chain destroy so that all RCU readers -- both dump threads and in-flight packet evaluation -- have finished before the chain is freed.

Affected Software

150 affected componentsFixes available

ubuntu/linux-hwe-edge*

ubuntu/linux-aws-5.0*

ubuntu/linux-aws-5.3*

ubuntu/linux-azure*

ubuntu/linux-azure-5.3*

ubuntu/linux-azure-edge*

ubuntu/linux-gcp*

ubuntu/linux-gcp-5.3*

ubuntu/linux-gke-4.15*

ubuntu/linux-gke-5.4*

ubuntu/linux-gkeop-5.4*

ubuntu/linux-hwe*

ubuntu/linux-hwe-edge*

ubuntu/linux-oem*

ubuntu/linux-oracle-5.0*

ubuntu/linux-oracle-5.3*

ubuntu/linux-aws-5.11*

ubuntu/linux-aws-5.13*

ubuntu/linux-aws-5.8*

ubuntu/linux-azure-5.11*

ubuntu/linux-azure-5.13*

ubuntu/linux-azure-5.8*

ubuntu/linux-azure-fde*

ubuntu/linux-gcp-5.11*

ubuntu/linux-gcp-5.13*

ubuntu/linux-gcp-5.8*

ubuntu/linux-gke*

ubuntu/linux-gke-5.15*

ubuntu/linux-gkeop*

ubuntu/linux-gkeop-5.15*

ubuntu/linux-hwe-5.11*

ubuntu/linux-hwe-5.13*

ubuntu/linux-hwe-5.8*

ubuntu/linux-intel-5.13*

ubuntu/linux-oem-5.10*

ubuntu/linux-oem-5.13*

ubuntu/linux-oem-5.6*

ubuntu/linux-oracle-5.11*

ubuntu/linux-oracle-5.13*

ubuntu/linux-oracle-5.8*

ubuntu/linux-raspi2*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.11*

ubuntu/linux-riscv-5.8*

ubuntu/linux-allwinner-5.19*

ubuntu/linux-aws-5.19*

ubuntu/linux-aws-6.2*

ubuntu/linux-aws-6.5*

ubuntu/linux-aws-6.8<6.8.0-1053.56~22.04.1

6.8.0-1053.56~22.04.1

ubuntu/linux-azure-5.19*

ubuntu/linux-azure-6.2*

ubuntu/linux-azure-6.5*

ubuntu/linux-azure-6.8<6.8.0-1059.65~22.04.1

6.8.0-1059.65~22.04.1

ubuntu/linux-azure-fde-5.19*

ubuntu/linux-azure-fde-6.2*

ubuntu/linux-azure-fde-6.8<6.8.0-1058.65~22.04.1

6.8.0-1058.65~22.04.1

ubuntu/linux-gcp-5.19*

ubuntu/linux-gcp-6.2*

ubuntu/linux-gcp-6.5*

ubuntu/linux-gcp-6.8<6.8.0-1060.63~22.04.1

6.8.0-1060.63~22.04.1

ubuntu/linux-hwe-5.19*

ubuntu/linux-hwe-6.2*

ubuntu/linux-hwe-6.5*

ubuntu/linux-hwe-6.8<6.8.0-111.111~22.04.1

6.8.0-111.111~22.04.1

ubuntu/linux-ibm-6.8<6.8.0-1052.52~22.04.1

6.8.0-1052.52~22.04.1

ubuntu/linux-intel-iot-realtime*

ubuntu/linux-lowlatency-hwe-5.19*

ubuntu/linux-lowlatency-hwe-6.2*

ubuntu/linux-lowlatency-hwe-6.5*

ubuntu/linux-lowlatency-hwe-6.8<6.8.0-111.111.1~22.04.1

6.8.0-111.111.1~22.04.1

ubuntu/linux-nvidia-6.2*

ubuntu/linux-nvidia-6.5*

ubuntu/linux-nvidia-6.8<6.8.0-1052.55~22.04.1

6.8.0-1052.55~22.04.1

ubuntu/linux-oem-5.17*

ubuntu/linux-oem-6.0*

ubuntu/linux-oem-6.1*

ubuntu/linux-oem-6.5*

ubuntu/linux-oracle-6.5*

ubuntu/linux-oracle-6.8<6.8.0-1050.51~22.04.1

6.8.0-1050.51~22.04.1

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.19*

ubuntu/linux-riscv-6.5*

ubuntu/linux-riscv-6.8<6.8.0-111.111~22.04.1

6.8.0-111.111~22.04.1

ubuntu/linux-starfive-5.19*

ubuntu/linux-starfive-6.2*

ubuntu/linux-starfive-6.5*

ubuntu/linux-realtime-6.8<6.8.1-1048.49~22.04.1

6.8.1-1048.49~22.04.1

ubuntu/linux<6.8.0-111.111

6.8.0-111.111

ubuntu/linux-aws<6.8.0-1053.56

6.8.0-1053.56

ubuntu/linux-aws-6.14*

ubuntu/linux-aws-6.17<6.17.0-1013.13~24.04.1

6.17.0-1013.13~24.04.1

ubuntu/linux-azure<6.8.0-1054.60

6.8.0-1054.60

ubuntu/linux-azure-6.11*

ubuntu/linux-azure-6.14*

ubuntu/linux-azure-6.17<6.17.0-1013.13~24.04.1

6.17.0-1013.13~24.04.1

ubuntu/linux-azure-fde<6.8.0-1058.65

6.8.0-1058.65

ubuntu/linux-azure-fde-6.14*

ubuntu/linux-azure-nvidia<6.8.0-1039.42

6.8.0-1039.42

ubuntu/linux-azure-nvidia-6.14*

ubuntu/linux-gcp<6.8.0-1055.58

6.8.0-1055.58

ubuntu/linux-gcp-6.11*

ubuntu/linux-gcp-6.14*

ubuntu/linux-gcp-6.17<6.17.0-1013.13~24.04.1

6.17.0-1013.13~24.04.1

ubuntu/linux-gke<6.8.0-1051.57

6.8.0-1051.57

ubuntu/linux-gkeop<6.8.0-1038.41

6.8.0-1038.41

ubuntu/linux-hwe-6.11*

ubuntu/linux-hwe-6.14*

ubuntu/linux-hwe-6.17<6.17.0-23.23~24.04.1

6.17.0-23.23~24.04.1

ubuntu/linux-ibm<6.8.0-1052.52

6.8.0-1052.52

ubuntu/linux-lowlatency<6.8.0-111.111.1

6.8.0-111.111.1

ubuntu/linux-lowlatency-hwe-6.11*

ubuntu/linux-nvidia<6.8.0-1052.55

6.8.0-1052.55

ubuntu/linux-nvidia-6.11*

ubuntu/linux-nvidia-6.17<6.17.0-1026.26

6.17.0-1026.26

ubuntu/linux-nvidia-lowlatency<6.8.0-1052.55.1

6.8.0-1052.55.1

ubuntu/linux-nvidia-tegra<6.8.0-1023.23

6.8.0-1023.23

ubuntu/linux-oem-6.11*

ubuntu/linux-oem-6.14*

ubuntu/linux-oem-6.17<6.17.0-1020.20

6.17.0-1020.20

ubuntu/linux-oem-6.8*

ubuntu/linux-oracle<6.8.0-1050.51

6.8.0-1050.51

ubuntu/linux-oracle-6.14*

ubuntu/linux-oracle-6.17<6.17.0-1014.14~24.04.1

6.17.0-1014.14~24.04.1

ubuntu/linux-raspi<6.8.0-1053.57

6.8.0-1053.57

ubuntu/linux-raspi-realtime*

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-riscv-6.14*

ubuntu/linux-riscv-6.17<6.17.0-23.23.1~24.04.1

6.17.0-23.23.1~24.04.1

ubuntu/linux-xilinx<6.8.0-1029.30

6.8.0-1029.30

ubuntu/linux-bluefield<6.8.0-1022.26

6.8.0-1022.26

ubuntu/linux-raspi-realtime<6.8.0-2043.44

6.8.0-2043.44

ubuntu/linux-realtime<6.8.1-1048.49

6.8.1-1048.49

ubuntu/linux-realtime-6.14*

ubuntu/linux-realtime-6.17<6.17.0-1011.12~24.04.1

6.17.0-1011.12~24.04.1

ubuntu/linux-aws-fips<6.8.0-1053.56+fips1

6.8.0-1053.56+fips1

ubuntu/linux-azure-fips<6.8.0-1054.60+fips1

6.8.0-1054.60+fips1

ubuntu/linux-fips<6.8.0-111.111+fips1

6.8.0-111.111+fips1

ubuntu/linux-gcp-fips<6.8.0-1055.58+fips1

6.8.0-1055.58+fips1

ubuntu/linux<6.17.0-23.23

6.17.0-23.23

ubuntu/linux-aws<6.17.0-1013.13

6.17.0-1013.13

ubuntu/linux-azure<6.17.0-1013.13

6.17.0-1013.13

ubuntu/linux-azure-fde*

ubuntu/linux-gcp<6.17.0-1013.13

6.17.0-1013.13

ubuntu/linux-oracle<6.17.0-1012.12

6.17.0-1012.12

ubuntu/linux-raspi<6.17.0-1014.14

6.17.0-1014.14

ubuntu/linux-realtime<6.17.0-1011.12

6.17.0-1011.12

ubuntu/linux-riscv<6.17.0-23.23.1

6.17.0-23.23.1

ubuntu/linux-vmware*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/linux-aws-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1053.56~22.04.1
Upgrade
Upgrade ubuntu/linux-azure-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1059.65~22.04.1
Upgrade
Upgrade ubuntu/linux-azure-fde-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1058.65~22.04.1
Upgrade
Upgrade ubuntu/linux-gcp-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1060.63~22.04.1
Upgrade
Upgrade ubuntu/linux-hwe-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-111.111~22.04.1
Upgrade
Upgrade ubuntu/linux-ibm-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1052.52~22.04.1
Upgrade
Upgrade ubuntu/linux-lowlatency-hwe-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-111.111.1~22.04.1
Upgrade
Upgrade ubuntu/linux-nvidia-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1052.55~22.04.1
Upgrade
Upgrade ubuntu/linux-oracle-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1050.51~22.04.1
Upgrade
Upgrade ubuntu/linux-riscv-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-111.111~22.04.1
Upgrade
Upgrade ubuntu/linux-realtime-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.1-1048.49~22.04.1
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 6.8.0-111.111
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 6.8.0-1053.56
Upgrade
Upgrade ubuntu/linux-aws-6.17 to a version that resolves this vulnerability.
Fixed in 6.17.0-1013.13~24.04.1
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 6.8.0-1054.60
Upgrade
Upgrade ubuntu/linux-azure-6.17 to a version that resolves this vulnerability.
Fixed in 6.17.0-1013.13~24.04.1
Upgrade
Upgrade ubuntu/linux-azure-fde to a version that resolves this vulnerability.
Fixed in 6.8.0-1058.65
Upgrade
Upgrade ubuntu/linux-azure-nvidia to a version that resolves this vulnerability.
Fixed in 6.8.0-1039.42
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 6.8.0-1055.58
Upgrade
Upgrade ubuntu/linux-gcp-6.17 to a version that resolves this vulnerability.
Fixed in 6.17.0-1013.13~24.04.1
Upgrade
Upgrade ubuntu/linux-gke to a version that resolves this vulnerability.
Fixed in 6.8.0-1051.57
Upgrade
Upgrade ubuntu/linux-gkeop to a version that resolves this vulnerability.
Fixed in 6.8.0-1038.41
Upgrade
Upgrade ubuntu/linux-hwe-6.17 to a version that resolves this vulnerability.
Fixed in 6.17.0-23.23~24.04.1
Upgrade
Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.
Fixed in 6.8.0-1052.52
Upgrade
Upgrade ubuntu/linux-lowlatency to a version that resolves this vulnerability.
Fixed in 6.8.0-111.111.1
Upgrade
Upgrade ubuntu/linux-nvidia to a version that resolves this vulnerability.
Fixed in 6.8.0-1052.55
Upgrade
Upgrade ubuntu/linux-nvidia-6.17 to a version that resolves this vulnerability.
Fixed in 6.17.0-1026.26
Upgrade
Upgrade ubuntu/linux-nvidia-lowlatency to a version that resolves this vulnerability.
Fixed in 6.8.0-1052.55.1
Upgrade
Upgrade ubuntu/linux-nvidia-tegra to a version that resolves this vulnerability.
Fixed in 6.8.0-1023.23
Upgrade
Upgrade ubuntu/linux-oem-6.17 to a version that resolves this vulnerability.
Fixed in 6.17.0-1020.20
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 6.8.0-1050.51
Upgrade
Upgrade ubuntu/linux-oracle-6.17 to a version that resolves this vulnerability.
Fixed in 6.17.0-1014.14~24.04.1
Upgrade
Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.
Fixed in 6.8.0-1053.57
Upgrade
Upgrade ubuntu/linux-riscv-6.17 to a version that resolves this vulnerability.
Fixed in 6.17.0-23.23.1~24.04.1
Upgrade
Upgrade ubuntu/linux-xilinx to a version that resolves this vulnerability.
Fixed in 6.8.0-1029.30
Upgrade
Upgrade ubuntu/linux-bluefield to a version that resolves this vulnerability.
Fixed in 6.8.0-1022.26
Upgrade
Upgrade ubuntu/linux-raspi-realtime to a version that resolves this vulnerability.
Fixed in 6.8.0-2043.44
Upgrade
Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.
Fixed in 6.8.1-1048.49
Upgrade
Upgrade ubuntu/linux-realtime-6.17 to a version that resolves this vulnerability.
Fixed in 6.17.0-1011.12~24.04.1
Upgrade
Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.
Fixed in 6.8.0-1053.56+fips1
Upgrade
Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.
Fixed in 6.8.0-1054.60+fips1
Upgrade
Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.
Fixed in 6.8.0-111.111+fips1
Upgrade
Upgrade ubuntu/linux-gcp-fips to a version that resolves this vulnerability.
Fixed in 6.8.0-1055.58+fips1
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 6.17.0-23.23
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 6.17.0-1013.13
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 6.17.0-1013.13
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 6.17.0-1013.13
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 6.17.0-1012.12
Upgrade
Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.
Fixed in 6.17.0-1014.14
Upgrade
Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.
Fixed in 6.17.0-1011.12
Upgrade
Upgrade ubuntu/linux-riscv to a version that resolves this vulnerability.
Fixed in 6.17.0-23.23.1
Compensating control
Add synchronize_rcu() between nft_chain_del() and nf_tables_chain_destroy() so all RCU readers, including nf_tables_dump_chains() and in-flight nft_do_chain() packet evaluation, finish before the chain is freed.

Event History

Mar 4, 2026

CVE Published

via OSV·01:15 PM

Data Sourced

via OSV·01:15 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who is exposed to this issue?

Systems using the listed Ubuntu Linux kernel packages are exposed when nf_tables chain creation reaches a hook-registration failure path. The affected code can expose both concurrent nftables chain-dump operations and in-flight packet processing.

What conditions are required to trigger the use-after-free?

An attacker or local user needs privileges sufficient to add an nf_tables chain and cause hook registration to fail. Exploitation also requires a concurrent RCU reader, either a chain dump or packet evaluation through a transient IPv4 hook during failed IPv6 hook registration for NFPROTO_INET.

Are packet-processing paths affected, or only nftables management operations?

Both are affected. A concurrent nf_tables chain dump can retain a reference after the chain is removed, and packets can enter nft_do_chain() through a temporarily installed IPv4 hook while the failed chain is being freed.

How can I determine whether a system has the fix?

The fix adds synchronize_rcu() after nft_chain_del() and before chain destruction in the nf_tables_addchain() error path. Verify that the installed kernel includes upstream commit 71e99ee20fc3f662555118cf1159443250647533 or Ubuntu’s corresponding update.

UBUNTU-CVE-2026-23231: Use After Free

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

What conditions are required to trigger the use-after-free?

Are packet-processing paths affected, or only nftables management operations?

How can I determine whether a system has the fix?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What conditions are required to trigger the use-after-free?

Are packet-processing paths affected, or only nftables management operations?

How can I determine whether a system has the fix?