CVE-2026-74565High· 7.8▾ TwilightIn the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: make nft_object rhltable per table The nft_object rhltable is global, this allows for accessing objects that are being dismangled from lookup pat…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 42.9 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 14.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.1%
0.1% → 0.1%
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_tables: make nft_object rhltable per table
The nft_object rhltable is global, this allows for accessing objects that are being dismangled from lookup path by other existing netns. Given the nft_obj_destroy() releases the object inmediately, this might lead to use-after-free of these objects that are being released. Make the existing rhltable per table to address this issue to deal with with the nft_rcv_nl_event() path too.
Update nft_obj_lookup() to take the table as non-const, otherwise, compiler complains when passing the objname_ht to rhltable_lookup().
Linux >= 4d44175aa5bb5f68772b1eb0306554812294ca52 < 4b549d32d34ee765527e63726bb1af984876e776Linux >= 4d44175aa5bb5f68772b1eb0306554812294ca52 < 523c881661dde67efb44fce38c8eed50a72a57c1Linux >= 4d44175aa5bb5f68772b1eb0306554812294ca52 < 1948e4f85b855618b5b9a27265f98d816f4cb7cbLinux >= 4d44175aa5bb5f68772b1eb0306554812294ca52 < 63ba12b664a2cd3220ed43e22c717715f4cc2ae8Linux >= 4d44175aa5bb5f68772b1eb0306554812294ca52 < 7d4789b58761d9d48d9b5f5e7e0a510c3bbfb3afLinux >= 4d44175aa5bb5f68772b1eb0306554812294ca52 < f4f699790590bd0896c48a71e9232a65198f92f0Linux 5.1Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-90055NoneIn the Linux kernel, the following vulnerability has been resolved: usb: atm: usbatm: fix invalid ci_range initialization syzbot reported a shift-out-of-bounds in __vcc_connect(): UBSAN: shift-out-of-bounds in net/atm/common.c:382:3…
CVE-2026-90060NoneIn the Linux kernel, the following vulnerability has been resolved: ALSA: control: Don't add invalid kcontrols to LED layer The kcontrol LED state layer tries to track the all associated kcontrol elements with naive assumptions that th…
CVE-2026-90168NoneRejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE-2026-90196NoneIn the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: validate topology volume range before allocation SOF treats the topology mixer min and max values as non-negative indices into its volume table
CVE-2026-90209NoneIn the Linux kernel, the following vulnerability has been resolved: s390/debug: Fix deadlock during unregister Unregistering an s390dbf debug area while one of the associated debugfs files is being written to can cause a deadlock: $ e…
CVE-2026-90221NoneIn the Linux kernel, the following vulnerability has been resolved: nfc: nci: fix use of uninitialized memory in CORE_INIT_RSP parsing nci_core_init_rsp_packet_v1() and nci_core_init_rsp_packet_v2() parse the CORE_INIT_RSP packet witho…