CVE-2026-23272

netfilter: nf_tables: unconditionally bump set->nelems before insertion

State: Published
Severity: 7.8 High
Published: Mar 20, 2026
Updated: Oct 30, 2026
Reserved: Jan 13, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_tables: unconditionally bump set->nelems before insertion

In case that the set is full, a new element gets published then removed without waiting for the RCU grace period, while RCU reader can be walking over it already.

To address this issue, add the element transaction even if set is full, but toggle the set_full flag to report -ENFILE so the abort path safely unwinds the set to its previous state.

As for element updates, decrement set->nelems to restore it.

A simpler fix is to call synchronize_rcu() in the error path. However, with a large batch adding elements to already maxed-out set, this could cause noticeable slowdown of such batches.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

CWE-416 Use After Free

Affected Products

Product	Versions
LinuxLinux	35d0ac9070ef619e3bf44324375878a1c540387b to before 25841e8d4241c6c3763e70ae95050f8108707b46Affected 35d0ac9070ef619e3bf44324375878a1c540387b to before 022effa9c54903858e443b1225370e6c758d03f6Affected 35d0ac9070ef619e3bf44324375878a1c540387b to before 25fcaef7948912652905e96922f36583a84fffedAffected 35d0ac9070ef619e3bf44324375878a1c540387b to before e3ccb11fc8249759d23326038c8db987ddaabc77Affected 35d0ac9070ef619e3bf44324375878a1c540387b to before 86bc4b1a0f672d47ac19f9022432cb6a2e01cb33Affected 35d0ac9070ef619e3bf44324375878a1c540387b to before 6826131c7674329335ca25df2550163eb8a1fd0cAffected 35d0ac9070ef619e3bf44324375878a1c540387b to before ccb8c8f3c1127cf34d18c737309897c68046bf21Affected 35d0ac9070ef619e3bf44324375878a1c540387b to before def602e498a4f951da95c95b1b8ce8ae68aa733aAffected fefdd79403e89b0c673965343b92e2e01e2713a8Affected 4.9.33 to before 4.10Affected
LinuxLinux	4.10Affected before 4.10Not affected 5.10.273 through 5.10.Not affected 5.15.224 through 5.15.Not affected 6.1.177 through 6.1.Not affected 6.6.141 through 6.6.Not affected 6.12.91 through 6.12.Not affected 6.18.17 through 6.18.Not affected 6.19.7 through 6.19.*Not affected 7.0 and laterNot affected

Product

Versions

LinuxLinux

35d0ac9070ef619e3bf44324375878a1c540387b to before 25841e8d4241c6c3763e70ae95050f8108707b46Affected
35d0ac9070ef619e3bf44324375878a1c540387b to before 022effa9c54903858e443b1225370e6c758d03f6Affected
35d0ac9070ef619e3bf44324375878a1c540387b to before 25fcaef7948912652905e96922f36583a84fffedAffected
35d0ac9070ef619e3bf44324375878a1c540387b to before e3ccb11fc8249759d23326038c8db987ddaabc77Affected
35d0ac9070ef619e3bf44324375878a1c540387b to before 86bc4b1a0f672d47ac19f9022432cb6a2e01cb33Affected
35d0ac9070ef619e3bf44324375878a1c540387b to before 6826131c7674329335ca25df2550163eb8a1fd0cAffected
35d0ac9070ef619e3bf44324375878a1c540387b to before ccb8c8f3c1127cf34d18c737309897c68046bf21Affected
35d0ac9070ef619e3bf44324375878a1c540387b to before def602e498a4f951da95c95b1b8ce8ae68aa733aAffected
fefdd79403e89b0c673965343b92e2e01e2713a8Affected
4.9.33 to before 4.10Affected

LinuxLinux

4.10Affected
before 4.10Not affected
5.10.273 through 5.10.*Not affected
5.15.224 through 5.15.*Not affected
6.1.177 through 6.1.*Not affected
6.6.141 through 6.6.*Not affected
6.12.91 through 6.12.*Not affected
6.18.17 through 6.18.*Not affected
6.19.7 through 6.19.*Not affected
7.0 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.