---
id: CVE-2026-23399
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  nf_tables: nft_dynset: fix possible stateful expression memleak in error path

  If cloning the second stateful expression in the element via GFP_ATOMIC
  fails, then the f…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  nf_tables: nft_dynset: fix possible stateful expression memleak in error path

  If cloning the second stateful expression in the element via GFP_ATOMIC
  fails, then the f…
severity: medium
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-401
vendor: linux
product: linux_kernel
affected:
  - 'linux_kernel >= 5.11.1, < 6.12.78'
  - 'linux_kernel >= 6.13, < 6.18.20'
  - 'linux_kernel >= 6.19, < 6.19.10'
  - linux_kernel = 5.11
  - linux_kernel = 7.0
patched:
  - linux_kernel 6.19.10
published: '2026-03-28'
updated: '2026-09-08'
sourceUpdated: '2026-09-08T09:17:49.613'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-23399'
references:
  - url: 'https://git.kernel.org/stable/c/0548a13b5a145b16e4da0628b5936baf35f51b43'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/31641c682db73353e4647e40735c7f2a75ff58ef'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/4357dbb1d9c35ca0b4443d71c98a48e6666f7689'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/c88a9fd26cee365bec932196f76175772a941cca'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/d1354873cbe3b344899c4311ac05897fd83e3f21'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/e6661add2d9c6913e1dad97336595e23a2bed195'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/eb7bf413e59945df03d4567b73ce464eebe2f4ea'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-019113.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
tags:
  - nvd
  - cve.org
epss: 0.00121
epssPercentile: 0.02197
ingestedAt: '2026-09-08T09:30:08.336Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

nf_tables: nft_dynset: fix possible stateful expression memleak in error path

If cloning the second stateful expression in the element via GFP_ATOMIC
fails, then the first stateful expression remains in place without being
released.

   unreferenced object (percpu) 0x607b97e9cab8 (size 16):
     comm "softirq", pid 0, jiffies 4294931867
     hex dump (first 16 bytes on cpu 3):
       00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
     backtrace (crc 0):
       pcpu_alloc_noprof+0x453/0xd80
       nft_counter_clone+0x9c/0x190 [nf_tables]
       nft_expr_clone+0x8f/0x1b0 [nf_tables]
       nft_dynset_new+0x2cb/0x5f0 [nf_tables]
       nft_rhash_update+0x236/0x11c0 [nf_tables]
       nft_dynset_eval+0x11f/0x670 [nf_tables]
       nft_do_chain+0x253/0x1700 [nf_tables]
       nft_do_chain_ipv4+0x18d/0x270 [nf_tables]
       nf_hook_slow+0xaa/0x1e0
       ip_local_deliver+0x209/0x330

## Affected

- `linux_kernel >= 5.11.1, < 6.12.78`
- `linux_kernel >= 6.13, < 6.18.20`
- `linux_kernel >= 6.19, < 6.19.10`
- `linux_kernel = 5.11`
- `linux_kernel = 7.0`

## Remediation

Upgrade past the affected range:

- `linux_kernel 6.19.10`