PatchSiren cyber security CVE debrief

CVE-2026-23458 Linux CVE debrief

A use-after-free vulnerability in the Linux kernel's netfilter ctnetlink subsystem allows local attackers to escalate privileges or cause denial of service. The flaw exists in ctnetlink_dump_exp_ct(), which stores a conntrack pointer in cb->data for netlink dump callbacks but releases the reference immediately after netlink_dump_start(). When dump operations span multiple rounds, subsequent recvmsg() calls trigger the dump callback ctnetlink_exp_ct_dump_table(), which dereferences the now-freed conntrack via nfct_help(ct), leading to slab-use-after-free on ct->ext. The root cause is missing .start and .done callbacks in netlink_dump_control to manage conntrack references across dump rounds—unlike other dump functions in the same file that properly implement these callbacks. KASAN detection confirms the vulnerability with reads of freed memory at ffff88810597ebf0. Affected versions span Linux kernel 3.10 through 7.0-rc4 across multiple stable branches. The fix adds proper .start and .done callbacks to hold and release conntrack references for the dump duration, and relocates the nfct_help() call after the cb->args[0] early-return check to prevent unnecessary dereferences.

Vendor: Linux
Product: Unknown
CVSS: HIGH 7.8
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-07-14
Original CVE updated: 2026-07-28
Advisory published: 2026-07-14
Advisory updated: 2026-07-28

Who should care

Linux system administrators, kernel security teams, container platform operators, and organizations running multi-tenant Linux environments where unprivileged users may have CAP_NET_ADMIN or where netfilter conntrack netlink interfaces are exposed. Cloud providers and hosting platforms with custom kernel builds should prioritize patching. Security researchers tracking kernel memory safety issues and netfilter subsystem vulnerabilities.

Technical summary

The vulnerability is a use-after-free (CWE-416) in net/netfilter/nf_conntrack_netlink.c. The ctnetlink_dump_exp_ct() function initializes a netlink dump with a conntrack pointer stored in cb->data, but calls nf_ct_put() immediately after netlink_dump_start(). The dump callback ctnetlink_exp_ct_dump_table() later accesses this pointer via nfct_help(ct), which dereferences ct->ext. When the conntrack has been freed via RCU (as shown in the KASAN trace: slab_free_after_rcu_debug → rcu_core), this becomes a use-after-free. The fix introduces ctnetlink_exp_ct_dump_start() and ctnetlink_exp_ct_dump_done() callbacks to properly hold (nf_ct_get()) and release (nf_ct_put()) the conntrack reference across the entire dump operation, matching the pattern used in ctnetlink_get_conntrack(). Additionally, nfct_help() is moved after the cb->args[0] check to avoid dereferencing when the dump is complete.

Defensive priority

HIGH

Recommended defensive actions

Apply kernel patches from stable branches: 5.10.253+, 5.15.203+, 6.1.167+, 6.6.130+, 6.12.78+, 6.18.20+, 6.19.10+, or 7.0-rc5+
Restrict CAP_NET_ADMIN capability to prevent unprivileged ctnetlink access
Monitor for suspicious ctnetlink netlink socket activity from non-administrative processes
Enable KASAN in test environments to detect similar use-after-free patterns
Review custom netfilter conntrack helpers for similar reference counting issues in netlink dump callbacks

Evidence notes

KASAN slab-use-after-free detected in ctnetlink_exp_ct_dump_table+0x4f/0x2e0 with read of size 8 at ffff88810597ebf0. Call trace shows netlink_dump → netlink_recvmsg → sock_recvmsg path. Allocation traced to __nf_conntrack_alloc via ctnetlink_create_conntrack, with free occurring via slab_free_after_rcu_debug in rcu_core context. Fix confirmed by kernel stable patches adding .start/.done callbacks to netlink_dump_control structure.

Sources and references

Verified primary and authoritative sources

CVE-2026-23458 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2026-23458

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2026-23458 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2026-23458

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Mitigation or vendor reference
Unverified legacy reference

URL: https://git.kernel.org/stable/c/04c8907ce4e3d3e26c5e1a3e47aa5d17082cbb56

416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch
Mitigation or vendor reference
Unverified legacy reference

URL: https://git.kernel.org/stable/c/5cb81eeda909dbb2def209dd10636b51549a3f8a

416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch
Mitigation or vendor reference
Unverified legacy reference

URL: https://git.kernel.org/stable/c/9821b47f669eb82791fa0b1a6ebaf9aa219bea72

416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch
Mitigation or vendor reference
Unverified legacy reference

URL: https://git.kernel.org/stable/c/bdf2724eefd4455a66863abb025bab8d3aa98c57

416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch
Mitigation or vendor reference
Unverified legacy reference

URL: https://git.kernel.org/stable/c/cd541f15b60e2257441398cf495d978f816d09f8

416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch
Mitigation or vendor reference
Unverified legacy reference

URL: https://git.kernel.org/stable/c/d8cd0efbccc5cfb0a80da744a7da76e1333ab925

416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch
Mitigation or vendor reference
Unverified legacy reference

URL: https://git.kernel.org/stable/c/f025171feef2ac65663d7986f1d5ff0c28d6b2a9

416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.