CVE-2026-23392: netfilter: nf_tables: release flowtable after rcu grace period on error

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• linux linux kernel4.16.1 and later · before 6.1.167
• linux linux kernel6.2 and later · before 6.6.130
• linux linux kernel6.7 and later · before 6.12.78
• linux linux kernel6.13 and later · before 6.18.20
• linux linux kernel6.19 and later · before 6.19.10
• linux linux kernel4.16
• linux linux kernel7.0

Versions reported by the vendor

Affected version ranges reported by the assigning authority (Linux). Independent of NVD's CPE analysis and usually ahead of it.

• Linux Linux

  • 4.16affected
  • 3b49e2e94e6ebb8b23d0955d9e898254455734f8 and later · before 29538fb3f412f3ce5ad9f97fe7fd84952dacd3afaffected · git
  • 3b49e2e94e6ebb8b23d0955d9e898254455734f8 and later · before ec0f801e5ce0162fc4fea95607c716b264d283fbaffected · git
  • 3b49e2e94e6ebb8b23d0955d9e898254455734f8 and later · before d2632de96ccb066e0131ad1494241b9c281c60b8affected · git
  • 3b49e2e94e6ebb8b23d0955d9e898254455734f8 and later · before adee3436ccd29f1e514c028899e400cbc6d84065affected · git
  • 3b49e2e94e6ebb8b23d0955d9e898254455734f8 and later · before 7e3955b282eae20d61c75e499c75eade51c20060affected · git
  • 3b49e2e94e6ebb8b23d0955d9e898254455734f8 and later · before c8092edb9a11f20f95ccceeb9422b7dd0df337bdaffected · git
  • 3b49e2e94e6ebb8b23d0955d9e898254455734f8 and later · before e78a2dcc7cfb87b64a631441ca7681492b347ef6affected · git
  • 3b49e2e94e6ebb8b23d0955d9e898254455734f8 and later · before d73f4b53aaaea4c95f245e491aa5eeb8a21874ceaffected · git
  • before 4.16not affected · semver

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2026-31431crypto: algif_aead - Revert to operating out-of-placeKEV
  90Now
• CVE-2022-0847A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe KEV
  89Now
• CVE-2021-22555Heap Out-Of-Bounds Write in Netfilter IP6T_SO_SET_REPLACEKEV
  85Now

Published before and after this one in the same product

• ← EarlierCVE-2026-23389Mar 25, 2026 · ice: Fix memory leak in ice_set_ringparam()
  22Monitor
• ← EarlierCVE-2026-23391Mar 25, 2026 · netfilter: xt_CT: drop pending enqueued packets on template removal
  31Monitor
• Later →CVE-2026-23395Mar 25, 2026 · Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ
  35Monitor

Root cause

After a memory region is freed, another reference pointing to it is still used. By then, the same region may have been allocated for different data.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1free(dev->buf);2/* ... another thread is still running ... */3process(dev->buf);

1lock(&dev->lock);2free(dev->buf);3dev->buf = NULL;4unlock(&dev->lock);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.

MITRE has no CAPEC/ATT&CK mapping for this CWE.