Use-after-free Vulnerability in Linux Kernel's Netfilter Component

CVE-2026-23351

What is CVE-2026-23351?

A use-after-free vulnerability has been identified in the Netfilter component of the Linux kernel, specifically within the pipapo set type. This issue arises during garbage collection (GC) when handling a large number of expired elements, potentially leading to soft lockup warnings and RCU stall reports. The vulnerability could allow local denial of service attacks as expired elements remain accessible to both the packet path and userspace dumpers. The issue necessitates a modification of the GC process to ensure a clear distinction between unlink and reclaim phases and to effectively manage pointer swapping to avoid exposure of freed elements.

References