CVE-2026-23399

Modified Modified - Updated After Analysis

Memory Leak in Linux Kernel nf_tables Stateful Expression Handling

Publication date: 2026-03-28

Last updated on: 2026-06-01

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: nf_tables: nft_dynset: fix possible stateful expression memleak in error path If cloning the second stateful expression in the element via GFP_ATOMIC fails, then the first stateful expression remains in place without being released. unreferenced object (percpu) 0x607b97e9cab8 (size 16): comm "softirq", pid 0, jiffies 4294931867 hex dump (first 16 bytes on cpu 3): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 backtrace (crc 0): pcpu_alloc_noprof+0x453/0xd80 nft_counter_clone+0x9c/0x190 [nf_tables] nft_expr_clone+0x8f/0x1b0 [nf_tables] nft_dynset_new+0x2cb/0x5f0 [nf_tables] nft_rhash_update+0x236/0x11c0 [nf_tables] nft_dynset_eval+0x11f/0x670 [nf_tables] nft_do_chain+0x253/0x1700 [nf_tables] nft_do_chain_ipv4+0x18d/0x270 [nf_tables] nf_hook_slow+0xaa/0x1e0 ip_local_deliver+0x209/0x330

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-03-28

Last Modified

2026-06-01

Generated

2026-07-06

AI Q&A

2026-03-28

EPSS Evaluated

2026-07-05

NVD

CVE-2026-23399

EUVD

EUVD-2026-16909

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	5.11
linux	linux_kernel	7.0
linux	linux_kernel	7.0
linux	linux_kernel	7.0
linux	linux_kernel	7.0
linux	linux_kernel	7.0
linux	linux_kernel	7.0
linux	linux_kernel	7.0
linux	linux_kernel	From 6.13 (inc) to 6.18.20 (exc)
linux	linux_kernel	From 6.19 (inc) to 6.19.10 (exc)
linux	linux_kernel	From 5.11.1 (inc) to 6.12.78 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-401	The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.

Attack-Flow Graph

Detection Guidance

This vulnerability involves a memory leak in the Linux kernel's nf_tables component related to stateful expression cloning failures. Detection would typically involve monitoring kernel logs for related error messages or memory leak indications.

You can check the kernel logs for messages related to nf_tables or softirq processes that might indicate the memory leak. For example, use the following command to search the kernel log:

dmesg | grep nf_tables
journalctl -k | grep nf_tables

Additionally, monitoring system memory usage and looking for unreferenced objects or unusual memory consumption in the kernel related to nf_tables may help detect the issue.

Impact Analysis

The impact of this vulnerability is a potential memory leak in the Linux kernel's nf_tables subsystem. Over time, this could lead to increased memory usage and possibly degrade system performance or stability, especially under conditions where the cloning failure occurs frequently.

Executive Summary

This vulnerability exists in the Linux kernel's nf_tables component, specifically in the nft_dynset module. It involves a possible memory leak when cloning stateful expressions. If cloning the second stateful expression in an element fails due to GFP_ATOMIC allocation failure, the first stateful expression is not properly released, causing a memory leak.

Mitigation Strategies

The vulnerability has been resolved in the Linux kernel by fixing the memory leak in the nf_tables nft_dynset component. The immediate mitigation step is to update your Linux kernel to a version that includes this fix.

If updating the kernel is not immediately possible, consider limiting or disabling the use of nf_tables features that involve stateful expressions to reduce the risk of triggering the memory leak.

Hi! I’m here to help you understand CVE-2026-23399. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70