{"id":"CVE-2026-23412","summary":"netfilter: bpf: defer hook memory release until rcu readers are done","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: bpf: defer hook memory release until rcu readers are done\n\nYiming Qian reports UaF when concurrent process is dumping hooks via\nnfnetlink_hooks:\n\nBUG: KASAN: slab-use-after-free in nfnl_hook_dump_one.isra.0+0xe71/0x10f0\nRead of size 8 at addr ffff888003edbf88 by task poc/79\nCall Trace:\n \u003cTASK\u003e\n nfnl_hook_dump_one.isra.0+0xe71/0x10f0\n netlink_dump+0x554/0x12b0\n nfnl_hook_get+0x176/0x230\n [..]\n\nDefer release until after concurrent readers have completed.","modified":"2026-07-15T01:48:54.791743647Z","published":"2026-04-02T11:40:53.528Z","related":["SUSE-SU-2026:1643-1","SUSE-SU-2026:21114-1","SUSE-SU-2026:21123-1","SUSE-SU-2026:21255-1","SUSE-SU-2026:2217-1","SUSE-SU-2026:2238-1"],"database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23412.json","cna_assigner":"Linux"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/24f90fa3994b992d1a09003a3db2599330a5232a"},{"type":"WEB","url":"https://git.kernel.org/stable/c/54244d54a971c26a0cd0a9073460ff71f3c51b32"},{"type":"WEB","url":"https://git.kernel.org/stable/c/c25e0dec366ae99b7264324ce3c7cbaea34691f9"},{"type":"WEB","url":"https://git.kernel.org/stable/c/cb2bf5efdb02a2a59faf603604a1066e8266f349"},{"type":"WEB","url":"https://git.kernel.org/stable/c/d016c216bc75c45128160593a77b864a04dbe7c0"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23412.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23412"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"84601d6ee68ae820dec97450934797046d62db4b"},{"fixed":"d016c216bc75c45128160593a77b864a04dbe7c0"},{"fixed":"cb2bf5efdb02a2a59faf603604a1066e8266f349"},{"fixed":"c25e0dec366ae99b7264324ce3c7cbaea34691f9"},{"fixed":"54244d54a971c26a0cd0a9073460ff71f3c51b32"},{"fixed":"24f90fa3994b992d1a09003a3db2599330a5232a"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-23412.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.4.0"},{"fixed":"6.6.130"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.12.78"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.20"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"6.19.10"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-23412.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}