---
id: CVE-2026-23412
title: 'netfilter: bpf: defer hook memory release until rcu readers are done'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  netfilter: bpf: defer hook memory release until rcu readers are done

  Yiming Qian reports UaF when concurrent process is dumping hooks via
  nfnetlink_hooks:

  BUG: KASAN:…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 84601d6ee68ae820dec97450934797046d62db4b <
    d016c216bc75c45128160593a77b864a04dbe7c0
  - >-
    Linux >= 84601d6ee68ae820dec97450934797046d62db4b <
    cb2bf5efdb02a2a59faf603604a1066e8266f349
  - >-
    Linux >= 84601d6ee68ae820dec97450934797046d62db4b <
    c25e0dec366ae99b7264324ce3c7cbaea34691f9
  - >-
    Linux >= 84601d6ee68ae820dec97450934797046d62db4b <
    54244d54a971c26a0cd0a9073460ff71f3c51b32
  - >-
    Linux >= 84601d6ee68ae820dec97450934797046d62db4b <
    24f90fa3994b992d1a09003a3db2599330a5232a
  - Linux 6.4
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T15:07:44.417268Z'
published: '2026-04-02'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:09:55.129Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-23412'
references:
  - url: 'https://git.kernel.org/stable/c/d016c216bc75c45128160593a77b864a04dbe7c0'
  - url: 'https://git.kernel.org/stable/c/cb2bf5efdb02a2a59faf603604a1066e8266f349'
  - url: 'https://git.kernel.org/stable/c/c25e0dec366ae99b7264324ce3c7cbaea34691f9'
  - url: 'https://git.kernel.org/stable/c/54244d54a971c26a0cd0a9073460ff71f3c51b32'
  - url: 'https://git.kernel.org/stable/c/24f90fa3994b992d1a09003a3db2599330a5232a'
tags:
  - cve.org
epss: 0.00117
epssPercentile: 0.01544
ingestedAt: '2026-10-16T17:24:46.644Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

netfilter: bpf: defer hook memory release until rcu readers are done

Yiming Qian reports UaF when concurrent process is dumping hooks via
nfnetlink_hooks:

BUG: KASAN: slab-use-after-free in nfnl_hook_dump_one.isra.0+0xe71/0x10f0
Read of size 8 at addr ffff888003edbf88 by task poc/79
Call Trace:
 <TASK>
 nfnl_hook_dump_one.isra.0+0xe71/0x10f0
 netlink_dump+0x554/0x12b0
 nfnl_hook_get+0x176/0x230
 [..]

Defer release until after concurrent readers have completed.

## Affected

- `Linux >= 84601d6ee68ae820dec97450934797046d62db4b < d016c216bc75c45128160593a77b864a04dbe7c0`
- `Linux >= 84601d6ee68ae820dec97450934797046d62db4b < cb2bf5efdb02a2a59faf603604a1066e8266f349`
- `Linux >= 84601d6ee68ae820dec97450934797046d62db4b < c25e0dec366ae99b7264324ce3c7cbaea34691f9`
- `Linux >= 84601d6ee68ae820dec97450934797046d62db4b < 54244d54a971c26a0cd0a9073460ff71f3c51b32`
- `Linux >= 84601d6ee68ae820dec97450934797046d62db4b < 24f90fa3994b992d1a09003a3db2599330a5232a`
- `Linux 6.4`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.