CVE-2026-23111: netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate()

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• linux linux kernel4.19.316 and later · before 4.20
• linux linux kernel5.4.262 and later · before 5.5
• linux linux kernel5.10.188 and later · before 5.11
• linux linux kernel5.15.121 and later · before 5.15.200
• linux linux kernel6.1.36 and later · before 6.1.163
• linux linux kernel6.3.10 and later · before 6.4
• linux linux kernel6.4.1 and later · before 6.6.124
• linux linux kernel6.7 and later · before 6.12.70
• linux linux kernel6.13 and later · before 6.18.10
• linux linux kernel6.19
• linux linux kernel6.4

Versions reported by the vendor

Affected version ranges reported by the assigning authority (Linux). Independent of NVD's CPE analysis and usually ahead of it.

• Linux Linux

  • bc9f791d2593f17e39f87c6e2b3a36549a3705b1, 3c7ec098e3b588434a8b07ea9b5b36f04cef1f50, a136b7942ad2a50de708f76ea299ccb45ac7a7f9, dc7cdf8cbcbf8b13de1df93f356ec04cdeef5c41, 6.4affected
  • 25aa2ad37c2162be1c0bc4fe6397f7e4c13f00f8 and later · before 8c760ba4e36c750379d13569f23f5a6e185333f5affected · git
  • d60be2da67d172aecf866302c91ea11533eca4d9 and later · before b9b6573421de51829f7ec1cce76d85f5f6fbbd7faffected · git
  • 628bd3e49cba1c066228e23d71a852c23e26da73 and later · before 42c574c1504aa089a0a142e4c13859327570473daffected · git
  • 628bd3e49cba1c066228e23d71a852c23e26da73 and later · before 1444ff890b4653add12f734ffeffc173d42862ddaffected · git
  • 628bd3e49cba1c066228e23d71a852c23e26da73 and later · before 8b68a45f9722f2babe9e7bad00aa74638addf081affected · git
  • 628bd3e49cba1c066228e23d71a852c23e26da73 and later · before f41c5d151078c5348271ffaf8e7410d96f2d82f8affected · git
  • 5.15.121 and later · before 5.15.200affected · semver
  • 6.1.36 and later · before 6.1.163affected · semver
  • 4.19.316 and later · before 4.20affected · semver

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2026-31431crypto: algif_aead - Revert to operating out-of-placeKEV
  90Now
• CVE-2022-0847A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe KEV
  89Now
• CVE-2021-22555Heap Out-Of-Bounds Write in Netfilter IP6T_SO_SET_REPLACEKEV
  85Now

Published before and after this one in the same product

• ← EarlierCVE-2026-23108Feb 4, 2026 · can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak
  22Monitor
• ← EarlierCVE-2026-23110Feb 4, 2026 · scsi: core: Wake up the error handler when final completions race against each other
  18Monitor
• Later →CVE-2026-23112Feb 13, 2026 · nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec
  39Monitor

Root cause

After a memory region is freed, another reference pointing to it is still used. By then, the same region may have been allocated for different data.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1free(dev->buf);2/* ... another thread is still running ... */3process(dev->buf);

1lock(&dev->lock);2free(dev->buf);3dev->buf = NULL;4unlock(&dev->lock);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.

MITRE has no CAPEC/ATT&CK mapping for this CWE.