CVE-2026-23392: Linux Kernel Use-After-Free Vulnerability

CVE-2026-23392 Overview

CVE-2026-23392 is a use-after-free vulnerability [CWE-416] in the Linux kernel's netfilter subsystem, specifically in the nf_tables flowtable implementation. The flaw resides in the flowtable error path, where hooks are unregistered without waiting for a Read-Copy-Update (RCU) grace period. A hook referencing the flowtable may already be registered, exposing the freed flowtable to the packet path and the nfnetlink_hook control plane. Kernel Address Sanitizer (KASAN) uncovered the issue as a use-after-free when dumping hooks via nfnetlink_hook. Local attackers with low privileges can leverage the flaw to compromise kernel memory integrity.

Critical Impact
A local attacker with the ability to manipulate nf_tables flowtables can trigger use-after-free conditions in the kernel, potentially leading to privilege escalation, kernel memory corruption, or denial of service.

Affected Products

Linux Kernel (multiple stable branches prior to the fix commits)
Linux Kernel 4.16
Linux Kernel 7.0 release candidates (rc1 through rc7)

Discovery Timeline

2026-03-25 - CVE-2026-23392 published to NVD
2026-04-24 - Last updated in NVD database

Technical Details for CVE-2026-23392

Vulnerability Analysis

The vulnerability exists in the nf_tables flowtable creation path inside the Linux kernel netfilter subsystem. When flowtable setup fails late in the registration process, the kernel unregisters its hooks and releases the flowtable structure. The original code released the flowtable immediately without invoking synchronize_rcu(). Other readers traversing the hook list under RCU protection may still hold references to the flowtable. Freeing the structure while concurrent readers operate creates a classic use-after-free condition reachable from both the packet processing path and the nfnetlink_hook dump operation.

KASAN flagged the issue when concurrent userspace processes dumped hooks through nfnetlink_hook while a flowtable registration failed. The exposure window is small but reachable from unprivileged local contexts that hold CAP_NET_ADMIN within a user namespace.

Root Cause

The root cause is missing RCU synchronization in the flowtable error path. The kernel registers hooks before fully completing flowtable setup. If a later step fails, such as exceeding the maximum number of hooks or a hardware offload setup failure, the rollback path unregisters hooks and frees memory without waiting for in-flight RCU readers to finish. Concurrent operations like the nfnetlink_hook control plane dumping registered hooks then dereference freed flowtable memory.

Attack Vector

Exploitation requires local access and the ability to manipulate nf_tables objects, typically through CAP_NET_ADMIN privileges, which are obtainable in unprivileged user namespaces on many distributions. An attacker triggers the rare error path by exhausting hook resources or forcing a hardware offload failure, then races with nfnetlink_hook dump operations to dereference the freed flowtable. Successful exploitation of use-after-free conditions in netfilter has historically led to kernel privilege escalation.

No verified public proof-of-concept code is available. See the kernel stability commit fix for the upstream patch detailing the call to synchronize_rcu() in the error path.

Detection Methods for CVE-2026-23392

Indicators of Compromise

KASAN reports indicating use-after-free conditions originating from nfnetlink_hook or nf_tables flowtable code paths in kernel logs.
Unexpected kernel oops or panics referencing nf_flowtable, nft_flowtable, or hook list traversal functions.
Repeated nf_tables flowtable creation failures combined with concurrent nfnetlink_hook dump activity from unprivileged processes.

Detection Strategies

Enable KASAN on test kernels and monitor for use-after-free reports tied to netfilter symbols.
Audit kernel ring buffer output through dmesg and centralized logging for stack traces involving nft_flowtable_* functions.
Correlate suspicious process activity that creates user namespaces and invokes nf_tables netlink operations with kernel error events.

Monitoring Recommendations

Track creation of unprivileged user namespaces and use of CAP_NET_ADMIN by non-administrative processes.
Forward kernel logs and audit events to a centralized analytics platform for correlation across hosts.
Alert on kernel crashes or BUG reports referencing netfilter components, particularly on multi-tenant Linux systems.

How to Mitigate CVE-2026-23392

Immediate Actions Required

Apply the upstream kernel patches to all affected systems, prioritizing internet-facing and multi-tenant Linux hosts.
Inventory kernel versions across the environment and identify hosts running affected stable branches.
Restrict the ability of unprivileged users to create user namespaces if not required by workloads, reducing access to CAP_NET_ADMIN.

Patch Information

The Linux kernel maintainers released fixes across multiple stable branches. The patches add a synchronize_rcu() call after unregistering hooks in the flowtable error path, ensuring no concurrent RCU reader holds a stale reference before the flowtable is freed. Relevant commits include 7e3955b2, adee3436, c8092edb, d2632de9, d73f4b53, and e78a2dcc. Consume vendor-supplied kernel updates from your distribution as they become available.

Workarounds

Disable unprivileged user namespaces by setting kernel.unprivileged_userns_clone=0 (Debian/Ubuntu) or user.max_user_namespaces=0 where namespace functionality is not required.
Restrict loading of the nf_tables and nf_flow_table kernel modules on systems that do not require netfilter flowtable functionality.
Apply mandatory access control policies such as SELinux or AppArmor to limit which processes can issue nf_tables netlink operations.

bash

# Configuration example: restrict unprivileged user namespaces
sysctl -w kernel.unprivileged_userns_clone=0
echo 'kernel.unprivileged_userns_clone=0' >> /etc/sysctl.d/99-harden.conf

# Blacklist nf_tables flowtable modules where not required
echo 'install nf_flow_table /bin/true' >> /etc/modprobe.d/disable-nf-flowtable.conf