PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-23399 Linux CVE debrief

A memory leak vulnerability exists in the Linux kernel's nf_tables subsystem, specifically within the nft_dynset module. When cloning stateful expressions for dynamic set elements, if the second stateful expression clone fails due to GFP_ATOMIC allocation failure, the first successfully cloned stateful expression is not released, resulting in a memory leak of per-CPU objects. The leaked object trace indicates nft_counter_clone as the affected expression type. This vulnerability requires local access with privileges to configure nftables rules and can lead to gradual memory exhaustion affecting system availability.

Vendor
Linux
Product
Unknown
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-03-28
Original CVE updated
2026-06-01
Advisory published
2026-03-28
Advisory updated
2026-06-01

Who should care

Linux system administrators running nftables with dynamic sets; security teams managing kernel attack surface; hosting providers and cloud operators offering container or VM workloads with nftables networking; kernel maintainers tracking stable branch updates.

Technical summary

The vulnerability is located in nft_dynset_new() within net/netfilter/nft_dynset.c. When processing a dynamic set element update, stateful expressions attached to the element are cloned using GFP_ATOMIC allocations. If the first expression clones successfully but the second fails, the error path does not release the already-cloned first expression. The leaked memory is a per-CPU allocation (16 bytes in the reported trace) originating from nft_counter_clone. This occurs during softirq context via nft_rhash_update and nft_dynset_eval. The fix ensures proper cleanup of cloned expressions when subsequent clones fail.

Defensive priority

medium

Recommended defensive actions

  • Apply the relevant stable kernel patch for your version stream (5.x, 6.12.x, 6.13+, 6.19+, or 7.0-rc).
  • If immediate patching is not feasible, restrict unprivileged user namespaces and limit nftables configuration privileges to reduce attack surface.
  • Monitor for abnormal memory growth in systems running nftables with dynamic sets and stateful expressions (e.g., nft_counter).
  • Review kernel logs for GFP_ATOMIC allocation failures in nf_tables paths as potential indicators of trigger attempts.
  • Plan kernel updates during maintenance windows given local privilege requirements and availability impact rather than confidentiality or integrity compromise.

Evidence notes

CVE published 2026-03-28; modified 2026-06-01. NVD assigns CWE-401 (Missing Release of Memory after Effective Lifetime). CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H yields score 5.5 (MEDIUM). Affected kernel versions span 5.11.1 through 6.12.78, 6.13 through 6.18.20, 6.19 through 6.19.10, and 7.0-rc1 through 7.0-rc7 per NVD CPE criteria. Multiple stable kernel patches are available. No KEV listing.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-23399 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-23399

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-23399 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-23399

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/0548a13b5a145b16e4da0628b5936baf35f51b43

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/31641c682db73353e4647e40735c7f2a75ff58ef

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/4357dbb1d9c35ca0b4443d71c98a48e6666f7689

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/c88a9fd26cee365bec932196f76175772a941cca

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/d1354873cbe3b344899c4311ac05897fd83e3f21

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/e6661add2d9c6913e1dad97336595e23a2bed195

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/eb7bf413e59945df03d4567b73ce464eebe2f4ea

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.