High 7.8Published Mar 4, 2026

CVE-2026-23231netfilter: nf_tables: fix use-after-free in nf_tables_addchain()

Updated under an hour ago (Oct 26, 2026, 11:10 PM ET)

Does this affect you?

It affects Linux and 6 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: fix use-after-free in nf_tables_addchain() nf_tables_addchain() publishes the chain to table->chains via list_add_tail_rcu() (in nft_chain_add()) before registering hooks. If nf_tables_register_hook() then fails, the error path calls nft_chain_del() (list_del_rcu()) followed by nf_tables_chain_destroy() with no RCU grace period in between. This creates two use-after-free conditions: 1) Control-plane: nf_tables_dump_chains() traverses table->chains under rcu_read_lock(). A concurrent dump can still be walking the chain when the error path frees it. 2) Packet path: for NFPROTO_INET, nf_register_net_hook() briefly installs the IPv4 hook before IPv6 registration fails. Packets entering nft_do_chain() via the transient IPv4 hook can still be dereferencing chain->blob_gen_X when the error path frees the chain. Add synchronize_rcu() between nft_chain_del() and the chain destroy so that all RCU readers -- both dump threads and in-flight packet evaluation -- have finished before the chain is freed.

CVSS: 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-416
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	91c7b38dc9f0de4f7f444b796d14476bc12df7bc builds before 2a6586ecfa4ce1413daaafee250d2590e05f1a33; from 91c7b38dc9f0de4f7f444b796d14476bc12df7bc before 7017745068a9068904e1e7a1b170a5785647cc81; from 91c7b38dc9f0de4f7f444b796d14476bc12df7bc before f3fe58ce37926a10115ede527d59b91bcc05400a; from 91c7b38dc9f0de4f7f444b796d14476bc12df7bc before dbd0af8083dd201f07c49110b2ee93710abdff28; 91c7b38dc9f0de4f7f444b796d14476bc12df7bc builds before 2f9a4ffeb763aec822f8ff3d1e82202d27d46d4b; 91c7b38dc9f0de4f7f444b796d14476bc12df7bc builds before 71e99ee20fc3f662555118cf1159443250647533	CNA record
Siemens RUGGEDCOM RST2428P siemens:ruggedcom_rst2428p (from the name)	before V4.0	CISA ADP
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518_4_pn_dp_mfp (from the name)	from V3.1.6	CISA ADP
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518f_4_pn_dp_mfp (from the name)	from V3.1.6	CISA ADP
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem siemens:simatic_s7_1500_tm_mfp_gnu_linux_subsystem (from the name)	all versions	CISA ADP
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP siemens:siplus_s7_1500_cpu_1518_4_pn_dp_mfp (from the name)	from V3.1.6	CISA ADP
linux linux_kernel linux:linux_kernel	from 3.16 before 6.1.165; from 6.2 before 6.6.128; from 6.7 before 6.12.75; from 6.13 before 6.18.14; from 6.19 before 6.19.4	NVD

References

References

https://git.kernel.org/stable/c/2a6586ecfa4ce1413daaafee250d2590e05f1a33	patch
https://git.kernel.org/stable/c/7017745068a9068904e1e7a1b170a5785647cc81	patch
https://git.kernel.org/stable/c/f3fe58ce37926a10115ede527d59b91bcc05400a	patch
https://git.kernel.org/stable/c/dbd0af8083dd201f07c49110b2ee93710abdff28	patch
https://git.kernel.org/stable/c/2f9a4ffeb763aec822f8ff3d1e82202d27d46d4b	patch
https://git.kernel.org/stable/c/71e99ee20fc3f662555118cf1159443250647533	patch
https://cert-portal.siemens.com/productcert/html/ssa-019113.html
https://cert-portal.siemens.com/productcert/html/ssa-082556.html
https://cert-portal.siemens.com/productcert/html/ssa-253495.html
https://cert-portal.siemens.com/productcert/html/ssa-457936.html
1–10 of 11

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.