Linux Kernel Netfilter Packet Path Vulnerability Affecting Multiple Versions

CVE-2026-80837

What is CVE-2026-80837?

A vulnerability in the Linux kernel's netfilter subsystem allows for a race condition during the queuing of packet notifications. This occurs when packets are sent through a chain that references a depleted quota object, which can lead to the potential access of a freed memory structure. Specifically, the nft_obj_notify function is called from the packet path without holding necessary locks, resulting in a scenario where an immediate notification of queued packets is not correctly managed, giving rise to a slab-use-after-free condition that can be exploited by malicious tasks.

References