---
id: CVE-2026-23231
title: 'netfilter: nf_tables: fix use-after-free in nf_tables_addchain()'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  netfilter: nf_tables: fix use-after-free in nf_tables_addchain()

  nf_tables_addchain() publishes the chain to table->chains via
  list_add_tail_rcu() (in nft_chain_add())…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 91c7b38dc9f0de4f7f444b796d14476bc12df7bc <
    2a6586ecfa4ce1413daaafee250d2590e05f1a33
  - >-
    Linux >= 91c7b38dc9f0de4f7f444b796d14476bc12df7bc <
    7017745068a9068904e1e7a1b170a5785647cc81
  - >-
    Linux >= 91c7b38dc9f0de4f7f444b796d14476bc12df7bc <
    f3fe58ce37926a10115ede527d59b91bcc05400a
  - >-
    Linux >= 91c7b38dc9f0de4f7f444b796d14476bc12df7bc <
    dbd0af8083dd201f07c49110b2ee93710abdff28
  - >-
    Linux >= 91c7b38dc9f0de4f7f444b796d14476bc12df7bc <
    2f9a4ffeb763aec822f8ff3d1e82202d27d46d4b
  - >-
    Linux >= 91c7b38dc9f0de4f7f444b796d14476bc12df7bc <
    71e99ee20fc3f662555118cf1159443250647533
  - Linux 3.16
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-06-16T20:18:23.569815Z'
exploitAvailable: true
published: '2026-03-04'
updated: '2026-09-08'
sourceUpdated: '2026-09-08T08:45:05.203Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-23231'
references:
  - url: 'https://git.kernel.org/stable/c/2a6586ecfa4ce1413daaafee250d2590e05f1a33'
  - url: 'https://git.kernel.org/stable/c/7017745068a9068904e1e7a1b170a5785647cc81'
  - url: 'https://git.kernel.org/stable/c/f3fe58ce37926a10115ede527d59b91bcc05400a'
  - url: 'https://git.kernel.org/stable/c/dbd0af8083dd201f07c49110b2ee93710abdff28'
  - url: 'https://git.kernel.org/stable/c/2f9a4ffeb763aec822f8ff3d1e82202d27d46d4b'
  - url: 'https://git.kernel.org/stable/c/71e99ee20fc3f662555118cf1159443250647533'
tags:
  - cve.org
  - exploit-available
epss: 0.00788
epssPercentile: 0.54743
exploits:
  exploitdb: true
  checkedAt: '2026-09-24T07:53:00.859Z'
ingestedAt: '2026-09-08T15:33:26.993Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_tables: fix use-after-free in nf_tables_addchain()

nf_tables_addchain() publishes the chain to table->chains via
list_add_tail_rcu() (in nft_chain_add()) before registering hooks.
If nf_tables_register_hook() then fails, the error path calls
nft_chain_del() (list_del_rcu()) followed by nf_tables_chain_destroy()
with no RCU grace period in between.

This creates two use-after-free conditions:

 1) Control-plane: nf_tables_dump_chains() traverses table->chains
    under rcu_read_lock(). A concurrent dump can still be walking
    the chain when the error path frees it.

 2) Packet path: for NFPROTO_INET, nf_register_net_hook() briefly
    installs the IPv4 hook before IPv6 registration fails.  Packets
    entering nft_do_chain() via the transient IPv4 hook can still be
    dereferencing chain->blob_gen_X when the error path frees the
    chain.

Add synchronize_rcu() between nft_chain_del() and the chain destroy
so that all RCU readers -- both dump threads and in-flight packet
evaluation -- have finished before the chain is freed.

## Affected

- `Linux >= 91c7b38dc9f0de4f7f444b796d14476bc12df7bc < 2a6586ecfa4ce1413daaafee250d2590e05f1a33`
- `Linux >= 91c7b38dc9f0de4f7f444b796d14476bc12df7bc < 7017745068a9068904e1e7a1b170a5785647cc81`
- `Linux >= 91c7b38dc9f0de4f7f444b796d14476bc12df7bc < f3fe58ce37926a10115ede527d59b91bcc05400a`
- `Linux >= 91c7b38dc9f0de4f7f444b796d14476bc12df7bc < dbd0af8083dd201f07c49110b2ee93710abdff28`
- `Linux >= 91c7b38dc9f0de4f7f444b796d14476bc12df7bc < 2f9a4ffeb763aec822f8ff3d1e82202d27d46d4b`
- `Linux >= 91c7b38dc9f0de4f7f444b796d14476bc12df7bc < 71e99ee20fc3f662555118cf1159443250647533`
- `Linux 3.16`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.