CVE-2026-23231 in Linux
Summary
by MITRE • 03/04/2026
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_tables: fix use-after-free in nf_tables_addchain()
nf_tables_addchain() publishes the chain to table->chains via list_add_tail_rcu() (in nft_chain_add()) before registering hooks. If nf_tables_register_hook() then fails, the error path calls nft_chain_del() (list_del_rcu()) followed by nf_tables_chain_destroy() with no RCU grace period in between.
This creates two use-after-free conditions:
1) Control-plane: nf_tables_dump_chains() traverses table->chains under rcu_read_lock(). A concurrent dump can still be walking the chain when the error path frees it.
2) Packet path: for NFPROTO_INET, nf_register_net_hook() briefly installs the IPv4 hook before IPv6 registration fails. Packets entering nft_do_chain() via the transient IPv4 hook can still be dereferencing chain->blob_gen_X when the error path frees the chain.
Add synchronize_rcu() between nft_chain_del() and the chain destroy so that all RCU readers -- both dump threads and in-flight packet evaluation -- have finished before the chain is freed.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 06/24/2026
The vulnerability described in CVE-2026-23231 represents a critical use-after-free condition within the Linux kernel's netfilter subsystem, specifically affecting the nf_tables framework. This flaw manifests in the nf_tables_addchain() function where improper ordering of operations creates dangerous race conditions that can lead to system instability and potential privilege escalation. The vulnerability resides in the network packet filtering infrastructure that governs how packets are processed through various chain rules within the netfilter framework, making it particularly dangerous for network security and system stability.
The technical flaw occurs due to improper synchronization between the chain registration and cleanup processes within the netfilter subsystem. When nf_tables_addchain() executes, it first publishes the chain to the table's chains list using list_add_tail_rcu() before attempting to register the hooks. If the hook registration fails during nf_tables_register_hook(), the error path executes nft_chain_del() to remove the chain from the list followed immediately by nf_tables_chain_destroy() to free the memory without allowing proper RCU grace periods. This sequence creates a window where concurrent readers can still access freed memory, leading to undefined behavior and potential system crashes.
The operational impact of this vulnerability extends across both control-plane and packet-processing paths within the kernel networking stack. The first use-after-free condition affects control-plane operations where nf_tables_dump_chains() traverses the table->chains list under rcu_read_lock(), creating scenarios where dump operations can still access memory that has been freed by the error path. This can lead to kernel oops, system crashes, or data corruption during network configuration queries. The second condition affects the packet processing path, particularly for NFPROTO_INET which handles both IPv4 and IPv6 traffic, where transient hooks can be installed before full registration completes, allowing packets to be processed through freed chain structures during the brief window between hook installation and failure.
The vulnerability directly maps to CWE-416, which describes the use of memory after it has been freed, and demonstrates characteristics of CWE-362, which covers race conditions in concurrent systems. From an ATT&CK framework perspective, this vulnerability could be leveraged in privilege escalation scenarios where an attacker might craft malicious network traffic or configuration changes to trigger the race condition, potentially leading to kernel memory corruption. The vulnerability affects systems running Linux kernels with netfilter and nf_tables support, particularly those implementing complex packet filtering rules that utilize chain creation operations. Organizations should prioritize patching this vulnerability as it represents a fundamental race condition in kernel memory management that could be exploited to cause denial of service or potentially gain elevated privileges.
Mitigation strategies should focus on applying the kernel patch that introduces synchronize_rcu() between nft_chain_del() and chain destruction, ensuring proper RCU grace periods before memory deallocation. System administrators should also implement monitoring for unusual network configuration changes and packet processing errors that might indicate exploitation attempts. Additionally, regular kernel updates and security audits of network filtering configurations are recommended to prevent exploitation of similar race conditions in the netfilter subsystem. The fix addresses both the immediate memory safety issue and ensures proper synchronization across all concurrent access patterns in the netfilter framework, protecting against both control-plane and packet-processing race conditions that could be exploited by malicious actors.