CVE-2026-23278

Root

Cause

During transaction processing in the Linux kernel's netfilter nf_tables subsystem, a map may contain both a live catchall element and a pending catchall element from a new batch. When the map itself is being removed, the code incorrectly toggles only the first viable catchall element instead of iterating over all pending ones. This incomplete cleanup leads to a warning and a use-after-free in nft_data_release, as seen in the kernel panic trace [1][2].

Exploitation

The vulnerability is triggered during an abort of a netfilter transaction that involves a map with multiple catchall elements while the map is being destroyed. An attacker with the ability to craft netfilter rules (requiring CAP_NET_ADMIN) could potentially induce this condition. No special network position is required beyond local access to the netlink socket used for nf_tables configuration [3].

Impact

The bug manifests as a kernel warning and a use-after-free in nft_data_release, leading to a system crash (denial of service). While the description does not confirm privilege escalation, the use-after-free nature could, under certain memory layouts, be leveraged for arbitrary code execution. The primary impact is a denial of service on affected systems [4].

Mitigation

The fix ensures that all pending catchall elements are walked during abort, preventing the use-after-free. Patches have been applied to the stable kernel tree and are available in commits [1][2][3][4]. Users should update to the latest kernel version that includes these fixes.