CVE-2026-23385: Linux Kernel Netfilter DoS Vulnerability

CVE-2026-23385 Overview

A memory management vulnerability has been identified in the Linux kernel's netfilter nf_tables subsystem. The vulnerability was discovered through Syzbot fuzzing with fault injection, which triggered a failing memory allocation using GFP_KERNEL that results in a kernel warning (WARN splat). The issue occurs in the nft_map_deactivate function within net/netfilter/nf_tables_api.c when handling set operations during table release.

The vulnerability affects the set cloning mechanism during flush operations, where improper memory handling can lead to system instability and potential denial of service conditions when processing netfilter table operations.

Critical Impact
Local attackers with sufficient privileges to interact with netfilter tables may trigger kernel warnings and potential system instability through crafted netlink operations that cause memory allocation failures during set deactivation.

Affected Products

Linux kernel (versions with vulnerable nf_tables implementation)
Systems running netfilter/nftables for packet filtering
Linux-based network appliances and firewalls using nf_tables

Discovery Timeline

March 25, 2026 - CVE CVE-2026-23385 published to NVD
March 25, 2026 - Last updated in NVD database

Technical Details for CVE-2026-23385

Vulnerability Analysis

The vulnerability resides in the Linux kernel's netfilter nf_tables API, specifically in the set management code. When a netlink socket is released and triggers nft_rcv_nl_event, the kernel attempts to release associated tables through __nft_release_table. During this process, the nft_map_deactivate function may encounter memory allocation failures when attempting to clone sets.

The root issue is that set cloning was being performed unconditionally during various iteration operations, including during table deletion. When a GFP_KERNEL allocation fails under memory pressure or fault injection conditions, the code path triggers a WARN at line 845 of nf_tables_api.c. The call trace shows the vulnerability path from sock_close through netlink_release to the problematic nft_map_deactivate function.

Root Cause

The vulnerability stems from overly aggressive set cloning behavior in the nf_tables implementation. Prior to the fix, the code would attempt to clone sets during various iteration operations, including when sets were being deleted or deactivated. This design was problematic because:

Cloning sets requires memory allocation with GFP_KERNEL
Memory allocation failures during deactivation lead to inconsistent state handling
Bound anonymous sets and sets being deleted do not need to be cloned

The fix introduces a new iteration type NFT_ITER_UPDATE_CLONE that restricts set cloning to only the flush set command during the preparation phase. The rbtree and pipapo backends were updated to only perform cloning when this specific iteration type is used.

Attack Vector

The vulnerability can be triggered by local users with privileges to manipulate netfilter tables. The attack path involves creating netlink sockets and configuring nf_tables rules, then triggering conditions that lead to memory allocation failures during set deactivation. While the immediate impact is a kernel warning, repeated exploitation could lead to resource exhaustion or system instability.

The vulnerability is exercised through the following code path:

sock_close → netlink_release → blocking_notifier_call_chain → nft_rcv_nl_event → __nft_release_table → nft_map_deactivate

When memory allocation fails during set iteration in nft_map_deactivate, the error condition is not gracefully handled, resulting in the observed WARN splat. The fix modifies the pipapo backend to use existing set clones when available, otherwise falling back to the existing set representation, eliminating the need to clone sets during deletion.

Detection Methods for CVE-2026-23385

Indicators of Compromise

Kernel warning messages containing nft_map_deactivate in system logs
WARN splats referencing net/netfilter/nf_tables_api.c:845
Unusual memory pressure or allocation failures related to netfilter operations
Repeated netlink socket creation and teardown activity

Detection Strategies

Monitor kernel logs (dmesg, /var/log/kern.log) for WARN messages from nf_tables_api.c
Deploy kernel tracing on nft_map_deactivate function for anomalous invocation patterns
Implement audit rules for netfilter table manipulation operations
Use fault injection detection to identify potential exploitation attempts

Monitoring Recommendations

Enable kernel auditing for netlink_release and related socket operations
Configure alerting on kernel WARN messages in netfilter subsystem components
Monitor system memory utilization for unusual patterns during netfilter operations
Review netfilter rule changes and table modifications for unauthorized activity

How to Mitigate CVE-2026-23385

Immediate Actions Required

Apply the kernel patches from the stable kernel tree immediately
Review systems for signs of exploitation by checking kernel logs for related warnings
Consider temporarily limiting access to netfilter configuration if patching is delayed
Ensure systems have adequate memory to reduce likelihood of allocation failures

Patch Information

The Linux kernel development team has released patches to address this vulnerability. The fix restricts set cloning to the flush set command only, introducing NFT_ITER_UPDATE_CLONE for this specific purpose. Multiple commits have been published to the stable kernel tree:

Workarounds

Restrict access to netfilter/nftables configuration to trusted administrators only
Implement resource limits on netlink socket operations where possible
Deploy security modules (SELinux/AppArmor) to limit netfilter manipulation capabilities
Monitor and alert on kernel warnings to detect potential exploitation attempts

bash

# Configuration example
# Restrict nftables access to root only
chmod 700 /usr/sbin/nft

# Enable kernel audit logging for netlink operations
auditctl -a always,exit -F arch=b64 -S socket -F a0=16 -k netlink_monitor

# Check kernel version for patch status
uname -r