CVE-2026-80837: Linux Kernel Use-After-Free Vulnerability

CVE-2026-80837 Overview

CVE-2026-80837 is a use-after-free vulnerability in the Linux kernel's netfilter subsystem, specifically in the nf_tables object notification code path. The flaw stems from unsynchronized access to the notify_list when nft_obj_notify() is invoked from the packet processing path via nft_quota_obj_eval(). Because the packet path holds no commit_mutex, a bare list_add_tail() races against list_del() and kfree_skb() on another CPU during netlink transaction commits. The result is a write to an already-freed sk_buff, detected by KASAN as a slab-use-after-free. The issue affects Linux kernel v7.2-rc4 and related development versions.

Critical Impact
Local users able to send packets through an nf_tables chain referencing a depleted quota object can trigger kernel memory corruption, potentially leading to denial of service or privilege escalation.

Affected Products

Linux kernel v7.2-rc4 (ac5b0e5651b1)
Linux kernel 7.2.0-rc6 (075b74841bd0)
Linux kernel builds containing commit 67cc570edaa0 ("netfilter: nf_tables: coalesce multiple notifications into one skbuff")

Discovery Timeline

2026-09-04 - CVE-2026-80837 published to NVD
2026-09-04 - Last updated in NVD database

Technical Details for CVE-2026-80837

Vulnerability Analysis

The defect resides in __nft_obj_notify() at net/netfilter/nf_tables_api.c:1211. Since commit 67cc570edaa0, notifications are no longer sent immediately through nfnetlink_send(). Instead, they are queued onto nft_net->notify_list via nft_notify_enqueue(), which performs a bare list_add_tail() without acquiring a lock. The notify_list has no dedicated lock. It is implicitly serialized by commit_mutex, which every other enqueue site holds while running inside a netlink transaction. The nft_commit_notify() drain routine at net/netfilter/nf_tables_api.c:10746 similarly performs list_del() and kfree_skb() under commit_mutex.

The exported nft_obj_notify() symbol is reachable from the packet processing path through its only in-tree caller, nft_quota_obj_eval() at net/netfilter/nft_quota.c:68. This caller notifies with GFP_ATOMIC while evaluating a rule for a transiting packet and holds no mutex. When a packet traverses a chain that references a depleted quota object, the unlocked list_add_tail() races against list_del() and kfree_skb() running on another CPU under commit_mutex.

Root Cause

The root cause is a violation of the implicit locking contract for notify_list. The commit_mutex was expected to serialize all list operations, but the packet path caller bypasses this guarantee. The WRITE_ONCE(prev->next, new) inside __list_add() then writes through an sk_buff that has already been freed by a concurrent transaction commit. The gfp argument still accepted by nft_obj_notify() is a leftover from the pre-67cc570edaa0 behavior, when the path called nfnetlink_send() directly and did not enqueue.

Attack Vector

A local attacker with the ability to configure nf_tables rules and generate network traffic can exploit the race. By creating a chain that references a depleted quota object, then transmitting packets through it while a separate task issues netlink batch commits, the attacker triggers the use-after-free. KASAN reporting shows the write occurring from softirq context during udp_sendmsg → nft_do_chain_inet → nft_quota_obj_eval → __nft_obj_notify. The freed object belongs to the skbuff_head_cache slab of size 232.

No verified public exploit code is available. Refer to the upstream kernel commits for technical patch details: Kernel Commit 6fa88d1 and Kernel Commit 68de7f3.

Detection Methods for CVE-2026-80837

Indicators of Compromise

KASAN reports of slab-use-after-free in __nft_obj_notify with writes into the skbuff_head_cache slab.
Kernel oops or panic traces referencing nft_quota_obj_eval, nft_do_chain_inet, and __nft_obj_notify from softirq context.
Unexpected kernel memory corruption or list-debug warnings on hosts running nf_tables quota objects.

Detection Strategies

Enable KASAN and LIST_DEBUG on test kernels to surface list corruption originating from __nft_obj_notify().
Audit loaded nft_quota modules and enumerate rulesets referencing quota objects with nft list ruleset.
Correlate crash telemetry with periods of high netlink transaction activity against nf_tables.

Monitoring Recommendations

Forward kernel log output (dmesg, journald) to a centralized log platform and alert on stack traces containing __nft_obj_notify or nft_quota_obj_eval.
Track unexpected kernel restarts on Linux hosts running affected kernel builds.
Monitor for local users creating nf_tables quota objects on multi-tenant systems, since exploitation requires ruleset configuration privileges.

How to Mitigate CVE-2026-80837

Immediate Actions Required

Inventory Linux hosts running kernel v7.2-rc4 through 7.2.0-rc6 and prioritize them for patching.
Apply the upstream fix that splits message construction into nft_obj_notify_alloc() and sends the skb immediately from the packet path caller.
Restrict CAP_NET_ADMIN on multi-tenant and container hosts to limit who can create nf_tables quota objects.

Patch Information

The upstream fix restores the pre-coalescing behavior for packet-path notifications. Message construction is factored into nft_obj_notify_alloc(). The exported nft_obj_notify() reached from the packet path sends the skb straight away, while nf_tables_obj_notify() running under commit_mutex continues to queue for transaction coalescing. Relevant commits: Kernel Commit 6fa88d1, Kernel Commit 68de7f3, Kernel Commit 7904b94, Kernel Commit df86c0e, and Kernel Commit e97e2d6.

Workarounds

Remove nft_quota objects from active rulesets where the patch cannot be applied immediately.
Unload the nft_quota kernel module on systems that do not require quota accounting: modprobe -r nft_quota.
Constrain untrusted users from creating nf_tables rules by removing CAP_NET_ADMIN from unprivileged namespaces (sysctl -w kernel.unprivileged_userns_clone=0 on distributions that expose this control).