CVE-2026-23274

Vulnerability

Overview CVE-2026-23274 is a vulnerability in the Linux kernel's netfilter xt_IDLETIMER module. The root cause is that IDLETIMER revision 0 rules reuse existing timers by label and unconditionally call mod_timer() on the timer structure. However, if the label was first created by revision 1 with the XT_IDLETIMER_ALARM flag set, the timer uses alarm semantics and its timer_list field (timer->timer) is never initialized. When a revision 0 rule subsequently reuses that label, it invokes mod_timer() on an uninitialized timer_list, leading to debugobject warnings and, if panic_on_warn=1 is set, a possible kernel panic.

Attack

Vector and Prerequisites Exploitation requires the ability to insert xt_IDLETIMER netfilter rules, which typically demands root privileges (CAP_NET (or CAP_NET_ADMIN). While an unprivileged user cannot directly trigger this, a privileged administrator or a compromised system service with netfilter capabilities can create a revision 1 ALARM timer and then insert a revision 0 rule reusing the same label, causing the undefined behavior.

Impact

The primary impact is a denial of service (system crash or panic) due to the kernel warning or panic. The CVSS v3 score is 7.8 (High), reflecting the potential for full availability loss. There is no indication of memory corruption exploitable for code execution beyond the panic condition.

Mitigation

Status The fix [1] has been committed to the stable kernel tree and is expected to be included in subsequent stable releases. The patch rejects revision 0 rule insertion when an existing timer with the same label is of ALARM type. System administrators should apply the relevant kernel update as soon as possible. No workaround is currently available for unpatched kernels.