CVE-2026-72435

netfilter: ipset: fix order of kfree_rcu() and rcu_assign_pointer()

State: Published
Severity: 7.8 High
Published: Aug 15, 2026
Updated: Oct 16, 2026
Reserved: Aug 9, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: ipset: fix order of kfree_rcu() and rcu_assign_pointer()

Sashiko pointed out that kfree_rcu() was called before rcu_assign_pointer() in handling the comment extension. Fix the order so that rcu_assign_pointer() called first.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	b57b2d1fa53fe8563bdfc66a33b844463b9af285 to before c9787d7c24ffd83019f379455e1b97fb4f0f75ebAffected b57b2d1fa53fe8563bdfc66a33b844463b9af285 to before 6e98407cb94e035bba98956adc9096a76d8b2a9fAffected b57b2d1fa53fe8563bdfc66a33b844463b9af285 to before 50b70f56f3baaff46599f59b2d93fa2540120776Affected b57b2d1fa53fe8563bdfc66a33b844463b9af285 to before d01b4b471f0fc5c396af62845e972ccf99cee29aAffected b57b2d1fa53fe8563bdfc66a33b844463b9af285 to before fcb565966534909377a16be5f7b065db2e25c8b5Affected b57b2d1fa53fe8563bdfc66a33b844463b9af285 to before 8087bb360a936a6314d22b567e4b861656943eb6Affected b57b2d1fa53fe8563bdfc66a33b844463b9af285 to before 93a775fd67f3ef34949a9523bfa69403ee74efddAffected b57b2d1fa53fe8563bdfc66a33b844463b9af285 to before 3ca9982a8882470aa0ac4e8bb9a552b181d1efcdAffected
LinuxLinux	4.2Affected before 4.2Not affected 5.10.261 through 5.10.Not affected 5.15.212 through 5.15.Not affected 6.1.178 through 6.1.Not affected 6.6.145 through 6.6.Not affected 6.12.97 through 6.12.Not affected 6.18.40 through 6.18.Not affected 7.1.5 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

b57b2d1fa53fe8563bdfc66a33b844463b9af285 to before c9787d7c24ffd83019f379455e1b97fb4f0f75ebAffected
b57b2d1fa53fe8563bdfc66a33b844463b9af285 to before 6e98407cb94e035bba98956adc9096a76d8b2a9fAffected
b57b2d1fa53fe8563bdfc66a33b844463b9af285 to before 50b70f56f3baaff46599f59b2d93fa2540120776Affected
b57b2d1fa53fe8563bdfc66a33b844463b9af285 to before d01b4b471f0fc5c396af62845e972ccf99cee29aAffected
b57b2d1fa53fe8563bdfc66a33b844463b9af285 to before fcb565966534909377a16be5f7b065db2e25c8b5Affected
b57b2d1fa53fe8563bdfc66a33b844463b9af285 to before 8087bb360a936a6314d22b567e4b861656943eb6Affected
b57b2d1fa53fe8563bdfc66a33b844463b9af285 to before 93a775fd67f3ef34949a9523bfa69403ee74efddAffected
b57b2d1fa53fe8563bdfc66a33b844463b9af285 to before 3ca9982a8882470aa0ac4e8bb9a552b181d1efcdAffected

LinuxLinux

4.2Affected
before 4.2Not affected
5.10.261 through 5.10.*Not affected
5.15.212 through 5.15.*Not affected
6.1.178 through 6.1.*Not affected
6.6.145 through 6.6.*Not affected
6.12.97 through 6.12.*Not affected
6.18.40 through 6.18.*Not affected
7.1.5 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.