CVE-2026-23351 Overview
CVE-2026-23351 is a use-after-free vulnerability [CWE-416] in the Linux kernel's netfilter subsystem, specifically within the nft_set_pipapo set type. Researcher Yiming Qian reported that under a large number of expired elements, commit-time garbage collection (GC) runs for an extended period in a non-preemptible context. This behavior triggers soft lockup warnings and RCU stall reports, resulting in a local denial of service. Expired elements remain exposed to both the packet path and userspace dumpers via the live copy of the data structure, creating a window where freed memory can be referenced. The flaw affects multiple stable Linux kernel branches up to 7.0-rc7.
Critical Impact
A local attacker with CAP_NET_ADMIN capability can trigger memory corruption in the netfilter pipapo set, leading to denial of service and potential privilege escalation through use-after-free conditions.
Affected Products
- Linux Kernel (multiple stable branches)
- Linux Kernel 5.6
- Linux Kernel 7.0-rc1 through 7.0-rc7
Discovery Timeline
- 2026-03-25 - CVE-2026-23351 published to NVD
- 2026-04-24 - Last updated in NVD database
Technical Details for CVE-2026-23351
Vulnerability Analysis
The vulnerability resides in the pipapo (PIle PAcket POlicies) set backend used by nftables for efficient packet matching. The pipapo set type maintains a clone-and-swap data structure where modifications occur on a clone before atomically replacing the live pointer. During commit-time garbage collection, expired elements are reclaimed in a single phase that does not properly separate unlinking from freeing.
The core issue is that call_rcu() does not provide sufficient protection in this code path. Dump operations or element lookups initiated after call_rcu() has fired can still observe freed elements unless the commit phase swaps the clone and live pointers before any new reader picks up the old version. This race window allows a use-after-free condition to materialize when concurrent readers access elements queued for freeing.
Root Cause
The root cause is improper sequencing of garbage collection operations within nft_set_pipapo. Elements were queued for freeing before pointer swaps completed, leaving freed memory accessible to packet path traversal and userspace netlink dumpers. The fix splits GC into two distinct phases: an unlink phase and a reclaim phase. This mirrors the approach taken for the rbtree backend in commit 35f83a75529a ("netfilter: nft_set_rbtree: don't gc elements on insert").
Attack Vector
Exploitation requires local access with privileges to manipulate netfilter rules, typically CAP_NET_ADMIN within a user namespace. An attacker creates an nftables ruleset using pipapo sets and populates them with a large number of elements that subsequently expire. Triggering commit operations forces GC to run in a non-preemptible context, producing soft lockups and exposing the use-after-free race. The technical details of the fix are documented in the upstream Kernel Commit c12d570.
Detection Methods for CVE-2026-23351
Indicators of Compromise
- Kernel soft lockup warnings referencing nft_pipapo_gc or pipapo_commit functions in dmesg or /var/log/kern.log.
- RCU stall reports identifying netfilter or nft_set_pipapo call stacks.
- KASAN reports flagging use-after-free conditions in nft_set_pipapo.c on instrumented kernels.
Detection Strategies
- Audit kernel version and netfilter modules against the patched commit hashes published on kernel.org.
- Monitor nftables ruleset modifications by unprivileged users or containers with CAP_NET_ADMIN in user namespaces.
- Enable kernel address sanitizer (KASAN) in test environments to surface use-after-free triggers during fuzzing.
Monitoring Recommendations
- Forward kernel ring buffer events to a centralized logging platform and alert on soft lockup and RCU stall patterns.
- Track nft and iptables-nft invocations through process auditing (auditd) to identify unusual ruleset churn.
- Inspect container workloads that grant unprivileged user namespace access and restrict CAP_NET_ADMIN where feasible.
How to Mitigate CVE-2026-23351
Immediate Actions Required
- Apply the upstream kernel patches referenced in the official stable tree commits to all affected systems.
- Restrict access to user namespaces and CAP_NET_ADMIN for untrusted local users and containers.
- Inventory all hosts running affected kernel versions and prioritize patching of multi-tenant and container hosts.
Patch Information
The Linux kernel maintainers released the fix across multiple stable branches. The patch splits the pipapo GC routine into unlink and reclaim phases so that elements are only freed after the live pointer has been swapped. Refer to the official commits: Kernel Commit 16f3595, Kernel Commit 500a50a, Kernel Commit 65ca51b, Kernel Commit 7864c66, Kernel Commit 9df9578, Kernel Commit aff1366, Kernel Commit c0f1f85, and Kernel Commit c12d570.
Workarounds
- Disable unprivileged user namespaces by setting kernel.unprivileged_userns_clone=0 where supported by the distribution.
- Avoid deploying nftables rulesets that rely on pipapo sets with large numbers of timeout-bound elements until patched.
- Apply seccomp or AppArmor profiles that block nft ruleset operations from untrusted container workloads.
# Verify running kernel version and check for the patched release
uname -r
# Restrict unprivileged user namespace creation (Debian/Ubuntu)
echo 'kernel.unprivileged_userns_clone=0' | sudo tee /etc/sysctl.d/99-cve-2026-23351.conf
sudo sysctl --system
# List nftables sets to identify pipapo usage
sudo nft list sets
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
