CVE-2026-23458: Linux Kernel Use-After-Free Vulnerability

CVE-2026-23458 Overview

A use-after-free vulnerability has been identified in the Linux kernel's netfilter subsystem, specifically within the ctnetlink_dump_exp_ct() function. This memory corruption flaw occurs when the function stores a conntrack pointer in cb->data for the netlink dump callback ctnetlink_exp_ct_dump_table(), but improperly drops the conntrack reference immediately after netlink_dump_start(). When a dump operation spans multiple rounds, subsequent recvmsg() calls trigger the dump callback which dereferences the now-freed conntrack via nfct_help(ct), resulting in a use-after-free condition on ct->ext.

Critical Impact

This use-after-free vulnerability in the Linux kernel netfilter ctnetlink subsystem can lead to memory corruption, potentially allowing kernel-level code execution or system crashes when processing netlink dumps.

Affected Products

• Linux kernel versions with affected netfilter ctnetlink implementation
• Systems running kernel versions prior to the security patch commits
• Linux distributions using vulnerable kernel builds with netfilter enabled

Discovery Timeline

• April 3, 2026 - CVE-2026-23458 published to NVD
• April 7, 2026 - Last updated in NVD database

Technical Details for CVE-2026-23458

Vulnerability Analysis

The vulnerability resides in the netfilter connection tracking netlink interface, which is responsible for managing and exporting connection tracking information to userspace. The core issue is a reference counting error in the dump operation lifecycle management.

When ctnetlink_dump_exp_ct() initiates a netlink dump operation, it stores a pointer to a conntrack structure in the callback data (cb->data). However, the function releases its reference to this conntrack object immediately after calling netlink_dump_start(), without considering that the dump may require multiple message rounds to complete.

The bug manifests because the netlink_dump_control structure lacks proper .start and .done callbacks to manage the conntrack reference across dump rounds. This contrasts with other dump functions in the same file, such as ctnetlink_get_conntrack, which correctly implement these callbacks for reference lifecycle management.

KASAN (Kernel Address Sanitizer) reports confirm the slab-use-after-free condition at ctnetlink_exp_ct_dump_table+0x4f/0x2e0, with the freed memory being accessed during subsequent netlink dump iterations.

Root Cause

The root cause is improper reference counting in the netlink dump operation lifecycle. Specifically:

1. ctnetlink_dump_exp_ct() stores a conntrack pointer in cb->data for use by the dump callback
2. The conntrack reference is dropped immediately after netlink_dump_start() returns
3. No .start or .done callbacks are registered in netlink_dump_control to maintain the reference
4. When dumps span multiple recvmsg() calls, the callback dereferences freed memory via nfct_help(ct)

The fix involves adding proper .start and .done callbacks to hold and release the conntrack reference for the entire duration of the dump operation, and moving the nfct_help() call after the cb->args[0] early-return check to avoid unnecessary dereferencing.

Attack Vector

The vulnerability can be triggered through the following mechanism:

An attacker with local access and appropriate privileges to interact with netlink sockets can initiate a conntrack dump operation that spans multiple message rounds. By timing the operations appropriately, the attacker can cause the dump callback to access freed memory when the second recvmsg() triggers the continuation of the dump.

The attack leverages the netfilter netlink interface (nfnetlink) through the following call path:

• sendmsg() → netlink_sendmsg() → nfnetlink_rcv() → ctnetlink_new_conntrack()
• recvmsg() → netlink_recvmsg() → netlink_dump() → ctnetlink_exp_ct_dump_table() (use-after-free occurs here)

Detection Methods for CVE-2026-23458

Indicators of Compromise

• KASAN slab-use-after-free reports in kernel logs referencing ctnetlink_exp_ct_dump_table
• Kernel crashes or panics related to netfilter conntrack operations
• Unexpected process terminations (e.g., processes named ctnetlink_poc or similar) with netlink socket activity

Detection Strategies

• Enable KASAN in kernel builds to detect use-after-free conditions at runtime
• Monitor kernel logs for call traces involving ctnetlink_exp_ct_dump_table, netlink_dump, and nfct_help
• Implement system call monitoring for suspicious patterns of sendmsg/recvmsg operations targeting netlink sockets

Monitoring Recommendations

• Deploy kernel-level monitoring for netfilter netlink operations, particularly those involving connection tracking dumps
• Utilize SentinelOne's Linux kernel protection capabilities to detect memory corruption exploitation attempts
• Configure audit rules for netlink socket operations with netfilter family identifiers

How to Mitigate CVE-2026-23458

Immediate Actions Required

• Apply the latest kernel security patches that include the fix for this vulnerability
• Restrict access to netlink sockets to trusted users and processes only
• Consider disabling or limiting netfilter connection tracking if not required in your environment

Patch Information

The vulnerability has been fixed in multiple kernel git commits. Apply one of the following patches based on your kernel version:

• Kernel Git Commit 04c8907
• Kernel Git Commit 5cb81ee
• Kernel Git Commit bdf2724
• Kernel Git Commit cd541f1
• Kernel Git Commit f025171
• Kernel Git Commit f04cc86

The fix adds proper .start and .done callbacks to the netlink_dump_control structure to maintain the conntrack reference throughout the dump operation lifecycle.

Workarounds

• Restrict CAP_NET_ADMIN capability to limit which processes can interact with netfilter netlink interfaces
• Use network namespaces to isolate untrusted workloads from netfilter configuration interfaces
• Deploy mandatory access control policies (SELinux/AppArmor) to restrict netlink socket access

# Restrict netlink socket access using iptables owner match
# This limits which users can create netlink connections
iptables -A OUTPUT -m owner --uid-owner root -j ACCEPT
iptables -A OUTPUT -m owner ! --uid-owner root -p all -j DROP

# Enable audit logging for netlink operations
auditctl -a always,exit -F arch=b64 -S socket -F a0=16 -k netlink_monitor