In the Linux kernel, the following vulnerability has been resolved:

netfilter: bpf: defer hook memory release until rcu readers are done

Yiming Qian reports UaF when concurrent process is dumping hooks via
nfnetlink_hooks:

BUG: KASAN: slab-use-after-free in nfnl_hook_dump_one.isra.0+0xe71/0x10f0
Read of size 8 at addr ffff888003edbf88 by task poc/79
Call Trace:
<TASK>
nfnl_hook_dump_one.isra.0+0xe71/0x10f0
netlink_dump+0x554/0x12b0
nfnl_hook_get+0x176/0x230
[..]

Defer release until after concurrent readers have completed.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00018.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
84601d6ee68ae820dec97450934797046d62db4b affected < d016c216bc75c45128160593a77b864a04dbe7c0
84601d6ee68ae820dec97450934797046d62db4b affected < cb2bf5efdb02a2a59faf603604a1066e8266f349
84601d6ee68ae820dec97450934797046d62db4b affected < c25e0dec366ae99b7264324ce3c7cbaea34691f9
84601d6ee68ae820dec97450934797046d62db4b affected < 54244d54a971c26a0cd0a9073460ff71f3c51b32
84601d6ee68ae820dec97450934797046d62db4b affected < 24f90fa3994b992d1a09003a3db2599330a5232a
Linux Linux affected
Version Status Constraints
6.4 affected —
0 unaffected < 6.4
6.6.130 unaffected ≤ 6.6.*
6.12.78 unaffected ≤ 6.12.*
6.18.20 unaffected ≤ 6.18.*
6.19.10 unaffected ≤ 6.19.*
7.0-rc5 unaffected ≤ *

No data.

No data.

No data.

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/24f90fa3994b992d1a09003a3db2599330a5232a cve-icon cve-icon
https://git.kernel.org/stable/c/54244d54a971c26a0cd0a9073460ff71f3c51b32 cve-icon cve-icon
https://git.kernel.org/stable/c/c25e0dec366ae99b7264324ce3c7cbaea34691f9 cve-icon cve-icon
https://git.kernel.org/stable/c/cb2bf5efdb02a2a59faf603604a1066e8266f349 cve-icon cve-icon
https://git.kernel.org/stable/c/d016c216bc75c45128160593a77b864a04dbe7c0 cve-icon cve-icon
History

Thu, 02 Apr 2026 12:00:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: netfilter: bpf: defer hook memory release until rcu readers are done Yiming Qian reports UaF when concurrent process is dumping hooks via nfnetlink_hooks: BUG: KASAN: slab-use-after-free in nfnl_hook_dump_one.isra.0+0xe71/0x10f0 Read of size 8 at addr ffff888003edbf88 by task poc/79 Call Trace: <TASK> nfnl_hook_dump_one.isra.0+0xe71/0x10f0 netlink_dump+0x554/0x12b0 nfnl_hook_get+0x176/0x230 [..] Defer release until after concurrent readers have completed.
Title netfilter: bpf: defer hook memory release until rcu readers are done
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-04-02T11:40:53.528Z

Reserved: 2026-01-13T15:37:46.013Z

Link: CVE-2026-23412

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-04-02T12:16:20.270

Modified: 2026-04-02T12:16:20.270

Link: CVE-2026-23412

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses

No weakness.