CVE-2026-23399

Vulnerability

Description

The vulnerability resides in the dynamic set (nft_dynset) implementation of the Linux kernel's netfilter framework. When adding a new element to a dynamic set, the kernel clones stateful expressions (such as counters) for the element. If cloning the second stateful expression fails (e.g., due to memory pressure), the first cloned expression is not freed, leading to a memory leak [1]. The backtrace shows the leak occurring via nft_counter_clone and nft_dynset_new functions.

Exploitation

An attacker with the ability to trigger dynamic set operations in nftables can exploit this vulnerability. Prerequisites include having the CAP_NET_ADMIN capability or being able to inject nftables rules that cause dynamic set updates. The attacker can repeatedly trigger the error path by exhausting memory (e.g., using GFP_ATOMIC allocation failures) to cause the leak, eventually depleting system memory.

Impact

Successful exploitation leads to a gradual memory leak, which can result in denial of service (DoS) due to resource exhaustion. The kernel may become unresponsive or crash when memory is exhausted. The CVSS v3 score is 5.5 (Medium), indicating a moderate severity with local access required.

Mitigation

The Linux kernel has released patches that fix the memory leak by ensuring the first expression is released if the second clone fails. The fix has been applied to multiple stable kernel branches [1][2][3][4]. Users should update to the latest patched kernel versions to mitigate this vulnerability.