---
id: CVE-2026-46324
title: 'netfilter: nf_tables: use list_del_rcu for netlink hooks'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  netfilter: nf_tables: use list_del_rcu for netlink hooks

  nft_netdev_unregister_hooks and __nft_unregister_flowtable_net_hooks need
  to use list_del_rcu(), this list can…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= f9a43007d3f7ba76d5e7f9421094f00f2ef202f8 <
    0bd93ce4f3c35e845532184331d7917d7e562c80
  - >-
    Linux >= f9a43007d3f7ba76d5e7f9421094f00f2ef202f8 <
    0f33e8ad6ac563ae2233dd7f75884e0ee010521d
  - >-
    Linux >= f9a43007d3f7ba76d5e7f9421094f00f2ef202f8 <
    f3224ee463f8f6f6ced7dcdf6081add4f8128527
  - Linux c73955a09408e7374d9abfd0e78ce3de9cda0635
  - Linux b09e6ccf0d12f9356e8e3508d3e3dce126298538
  - Linux 3fac8ce48fa9fd61ee9056d3ed48b2edefca8b82
  - Linux 9c413a8c8bb49cc16796371805ecb260e885bb2b
  - Linux a3940dcf552f2393d1e8f263b386593f98abe829
  - Linux 86c0154f4c3a56c5db8b9dd09e3ce885382c2c19
  - Linux >= 4.19.316 < 4.20
  - Linux >= 5.4.262 < 5.5
  - Linux >= 5.10.198 < 5.11
  - Linux >= 5.15.45 < 5.16
  - Linux >= 5.17.13 < 5.18
  - Linux >= 5.18.2 < 5.19
  - Linux 5.19
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T15:22:09.898894Z'
published: '2026-06-09'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:31:17.085Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-46324'
references:
  - url: 'https://git.kernel.org/stable/c/0bd93ce4f3c35e845532184331d7917d7e562c80'
  - url: 'https://git.kernel.org/stable/c/0f33e8ad6ac563ae2233dd7f75884e0ee010521d'
  - url: 'https://git.kernel.org/stable/c/f3224ee463f8f6f6ced7dcdf6081add4f8128527'
tags:
  - cve.org
epss: 0.00119
epssPercentile: 0.01619
ingestedAt: '2026-10-16T17:24:46.717Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_tables: use list_del_rcu for netlink hooks

nft_netdev_unregister_hooks and __nft_unregister_flowtable_net_hooks need
to use list_del_rcu(), this list can be walked by concurrent dumpers.

Add a new helper and use it consistently.

## Affected

- `Linux >= f9a43007d3f7ba76d5e7f9421094f00f2ef202f8 < 0bd93ce4f3c35e845532184331d7917d7e562c80`
- `Linux >= f9a43007d3f7ba76d5e7f9421094f00f2ef202f8 < 0f33e8ad6ac563ae2233dd7f75884e0ee010521d`
- `Linux >= f9a43007d3f7ba76d5e7f9421094f00f2ef202f8 < f3224ee463f8f6f6ced7dcdf6081add4f8128527`
- `Linux c73955a09408e7374d9abfd0e78ce3de9cda0635`
- `Linux b09e6ccf0d12f9356e8e3508d3e3dce126298538`
- `Linux 3fac8ce48fa9fd61ee9056d3ed48b2edefca8b82`
- `Linux 9c413a8c8bb49cc16796371805ecb260e885bb2b`
- `Linux a3940dcf552f2393d1e8f263b386593f98abe829`
- `Linux 86c0154f4c3a56c5db8b9dd09e3ce885382c2c19`
- `Linux >= 4.19.316 < 4.20`
- `Linux >= 5.4.262 < 5.5`
- `Linux >= 5.10.198 < 5.11`
- `Linux >= 5.15.45 < 5.16`
- `Linux >= 5.17.13 < 5.18`
- `Linux >= 5.18.2 < 5.19`
- `Linux 5.19`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.