CVE-2026-23412 Overview
CVE-2026-23412 is a use-after-free vulnerability [CWE-416] in the Linux kernel's netfilter BPF subsystem. The flaw occurs when a concurrent process dumps hooks via nfnetlink_hooks while hook memory is being released. KASAN detects a slab-use-after-free read in nfnl_hook_dump_one because hook memory is freed before concurrent RCU readers complete. The fix defers hook memory release until after RCU readers have finished accessing the data structures.
The vulnerability affects multiple Linux kernel releases including 6.4 and 7.0 release candidates rc1 through rc7. A local authenticated attacker with sufficient privileges to interact with nfnetlink_hooks can trigger the condition.
Critical Impact
Local exploitation can corrupt kernel memory, leading to privilege escalation, kernel information disclosure, or denial of service through kernel panic.
Affected Products
- Linux kernel 6.4 release
- Linux kernel 7.0 release candidates (rc1 through rc7)
- Multiple stable branches patched via upstream commits
Discovery Timeline
- 2026-04-02 - CVE-2026-23412 published to the National Vulnerability Database
- 2026-04-27 - Last updated in NVD database
Technical Details for CVE-2026-23412
Vulnerability Analysis
The vulnerability resides in the netfilter BPF hook management code within the Linux kernel. When a process queries registered netfilter hooks through the nfnetlink_hooks interface, the kernel walks hook lists and serializes hook metadata for userspace consumption. The function nfnl_hook_dump_one reads from hook structures protected by Read-Copy-Update (RCU) synchronization.
The original implementation released hook memory without waiting for in-flight RCU readers to complete. A concurrent thread executing netlink_dump and nfnl_hook_get could hold a reference to a hook structure that another thread freed. KASAN flagged this as a slab-use-after-free with an 8-byte read at the freed address.
The Kernel Address Sanitizer trace published in the advisory identifies the call chain through nfnl_hook_dump_one.isra.0+0xe71/0x10f0, netlink_dump+0x554/0x12b0, and nfnl_hook_get+0x176/0x230. Reading freed slab memory exposes attacker-controlled data if the slab is reallocated between free and access.
Root Cause
The root cause is improper synchronization between hook unregistration and concurrent dumpers. Hook memory was released through standard kfree paths rather than RCU-deferred freeing. RCU readers traversing hook structures could therefore access memory that had already been returned to the slab allocator.
Attack Vector
A local user invokes nfnetlink_hooks netlink queries while another path causes BPF hook deregistration. Race timing between the two operations triggers the use-after-free. Successful exploitation requires the attacker to perform heap grooming and win the race window between free and read.
No verified public exploit code is available for CVE-2026-23412. The vulnerability mechanism is described in upstream patch commits referenced in the Kernel Git Commit d016c21 and related fixes.
Detection Methods for CVE-2026-23412
Indicators of Compromise
- Kernel oops or panic messages referencing nfnl_hook_dump_one or nfnl_hook_get in dmesg output
- KASAN slab-use-after-free reports in kernel logs on systems with KASAN enabled
- Unexpected process crashes or kernel instability following netlink netfilter queries
Detection Strategies
- Audit kernel version banners against the patched commits to identify unpatched hosts
- Monitor auditd for unusual socket(AF_NETLINK, ..., NETLINK_NETFILTER) calls from unprivileged contexts
- Enable KASAN on test systems to surface latent use-after-free conditions during fuzzing
Monitoring Recommendations
- Correlate kernel ring buffer messages with EDR telemetry to detect post-exploitation behavior such as unexpected privilege transitions
- Track loaded kernel modules and BPF program loads to baseline expected netfilter activity
- Forward /var/log/kern.log and journald kernel facility entries to a centralized SIEM for retention and correlation
How to Mitigate CVE-2026-23412
Immediate Actions Required
- Apply the upstream kernel patches referenced in the vendor advisory commits and reboot affected systems
- Restrict access to nfnetlink_hooks by limiting CAP_NET_ADMIN to required service accounts
- Inventory kernel versions across the fleet and prioritize patching hosts running Linux 6.4 and 7.0 release candidates
Patch Information
The fix defers hook memory release until concurrent RCU readers complete. The patches are available in the following upstream commits: Kernel Git Commit 24f90fa, Kernel Git Commit 54244d5, Kernel Git Commit c25e0de, Kernel Git Commit cb2bf5e, and Kernel Git Commit d016c21. Apply distribution-provided stable kernel updates when available.
Workarounds
- Disable unprivileged user namespaces where operationally feasible to limit attack surface for local kernel exploits
- Remove CAP_NET_ADMIN from non-essential service accounts and containers
- Apply seccomp filters to block socket and sendmsg calls targeting NETLINK_NETFILTER from untrusted workloads
# Verify the running kernel version and check for patched commits
uname -r
# Restrict netlink netfilter access via sysctl where supported
sysctl -w kernel.unprivileged_userns_clone=0
# Drop CAP_NET_ADMIN from container runtimes (example: Docker)
docker run --cap-drop=NET_ADMIN <image>
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
