CVE-2026-23391

netfilter: xt_CT: drop pending enqueued packets on template removal

State: Published
Severity: 7.8 High
Published: Mar 25, 2026
Updated: Oct 19, 2026
Reserved: Jan 13, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: xt_CT: drop pending enqueued packets on template removal

Templates refer to objects that can go away while packets are sitting in nfqueue refer to:

- helper, this can be an issue on module removal. - timeout policy, nfnetlink_cttimeout might remove it.

The use of templates with zone and event cache filter are safe, since this just copies values.

Flush these enqueued packets in case the template rule gets removed.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

CWE-416 Use After Free

Affected Products

Product	Versions
LinuxLinux	24de58f465165298aaa8f286b2592f0163706cfe to before 55445134d42b84cb0a272e42c98d233ca65eca83Affected 24de58f465165298aaa8f286b2592f0163706cfe to before cc57506dd66555899560b9c0f24e813f034e12ecAffected 24de58f465165298aaa8f286b2592f0163706cfe to before d2d0bae0c9a2a17b6990a2966f5cdce0813d6256Affected 24de58f465165298aaa8f286b2592f0163706cfe to before 63b8097cea1923fe82cd598068d0796da8c015ecAffected 24de58f465165298aaa8f286b2592f0163706cfe to before 19a230dec6bb8928e3f96387f9085cf2c79bcef9Affected 24de58f465165298aaa8f286b2592f0163706cfe to before cb549925875fa06dd155e49db4ac2c5044c30f9cAffected 24de58f465165298aaa8f286b2592f0163706cfe to before 777d02efe3d630cca4c1b63962cec17c57711325Affected 24de58f465165298aaa8f286b2592f0163706cfe to before f62a218a946b19bb59abdd5361da85fa4606b96bAffected
LinuxLinux	3.4Affected before 3.4Not affected 5.10.253 through 5.10.Not affected 5.15.203 through 5.15.Not affected 6.1.167 through 6.1.Not affected 6.6.130 through 6.6.Not affected 6.12.78 through 6.12.Not affected 6.18.20 through 6.18.Not affected 6.19.10 through 6.19.*Not affected 7.0 and laterNot affected

Product

Versions

LinuxLinux

24de58f465165298aaa8f286b2592f0163706cfe to before 55445134d42b84cb0a272e42c98d233ca65eca83Affected
24de58f465165298aaa8f286b2592f0163706cfe to before cc57506dd66555899560b9c0f24e813f034e12ecAffected
24de58f465165298aaa8f286b2592f0163706cfe to before d2d0bae0c9a2a17b6990a2966f5cdce0813d6256Affected
24de58f465165298aaa8f286b2592f0163706cfe to before 63b8097cea1923fe82cd598068d0796da8c015ecAffected
24de58f465165298aaa8f286b2592f0163706cfe to before 19a230dec6bb8928e3f96387f9085cf2c79bcef9Affected
24de58f465165298aaa8f286b2592f0163706cfe to before cb549925875fa06dd155e49db4ac2c5044c30f9cAffected
24de58f465165298aaa8f286b2592f0163706cfe to before 777d02efe3d630cca4c1b63962cec17c57711325Affected
24de58f465165298aaa8f286b2592f0163706cfe to before f62a218a946b19bb59abdd5361da85fa4606b96bAffected

LinuxLinux

3.4Affected
before 3.4Not affected
5.10.253 through 5.10.*Not affected
5.15.203 through 5.15.*Not affected
6.1.167 through 6.1.*Not affected
6.6.130 through 6.6.*Not affected
6.12.78 through 6.12.*Not affected
6.18.20 through 6.18.*Not affected
6.19.10 through 6.19.*Not affected
7.0 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.