UBUNTU-CVE-2026-74565: Use After Free
In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: make nftobject rhltable per table The nftobject rhltable is global, this allows for accessing objects that are being dismangled from lookup path by other existing netns. Given the nftobjdestroy() releases the object inmediately, this might lead to use-after-free of these objects that are being released. Make the existing rhltable per table to address this issue to deal with with the nftrcvnlevent() path too. Update nftobjlookup() to take the table as non-const, otherwise, compiler complains when passing the objnameht to rhltablelookup().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-nvidia-tegrato a version that resolves this vulnerability.Fixed in 6.8.0-1036.39 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Ubuntu systems using the listed Linux kernel packages are in scope, including linux, linux-azure, linux-gcp, linux-aws-fips, linux-fips, linux-azure-fips, linux-gcp-fips, and linux-realtime. The issue involves netfilter nf_tables object handling across network namespaces.
What level of access does an attacker need?
The severity vector indicates local access, low privileges, no user interaction, high attack complexity, and an additional attack prerequisite. Successful exploitation can affect confidentiality, integrity, and availability within the vulnerable system's scope.
What is the underlying failure condition?
A global nft_object rhltable can allow lookup paths in one existing network namespace to access objects being removed from another. Because nft_obj_destroy() immediately releases those objects, this can result in a use-after-free condition.
What change resolves the issue?
The fix makes the nft_object rhltable per table rather than global, preventing cross-namespace access to objects undergoing removal. It also updates nft_obj_lookup() so the relevant table lookup can use the per-table object-name hash table.