CVE-2026-23399
Modified Modified - Updated After Analysis
Memory Leak in Linux Kernel nf_tables Stateful Expression Handling

Publication date: 2026-03-28

Last updated on: 2026-06-01

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: nf_tables: nft_dynset: fix possible stateful expression memleak in error path If cloning the second stateful expression in the element via GFP_ATOMIC fails, then the first stateful expression remains in place without being released.   unreferenced object (percpu) 0x607b97e9cab8 (size 16):     comm "softirq", pid 0, jiffies 4294931867     hex dump (first 16 bytes on cpu 3):       00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00     backtrace (crc 0):       pcpu_alloc_noprof+0x453/0xd80       nft_counter_clone+0x9c/0x190 [nf_tables]       nft_expr_clone+0x8f/0x1b0 [nf_tables]       nft_dynset_new+0x2cb/0x5f0 [nf_tables]       nft_rhash_update+0x236/0x11c0 [nf_tables]       nft_dynset_eval+0x11f/0x670 [nf_tables]       nft_do_chain+0x253/0x1700 [nf_tables]       nft_do_chain_ipv4+0x18d/0x270 [nf_tables]       nf_hook_slow+0xaa/0x1e0       ip_local_deliver+0x209/0x330
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-03-28
Last Modified
2026-06-01
Generated
2026-06-16
AI Q&A
2026-03-28
EPSS Evaluated
2026-06-15
NVD
CVE-2026-23399
EUVD
EUVD-2026-16909
Affected Vendors & Products
Showing 11 associated CPEs
Vendor Product Version / Range
linux linux_kernel 5.11
linux linux_kernel 7.0
linux linux_kernel 7.0
linux linux_kernel 7.0
linux linux_kernel 7.0
linux linux_kernel 7.0
linux linux_kernel 7.0
linux linux_kernel 7.0
linux linux_kernel From 6.13 (inc) to 6.18.20 (exc)
linux linux_kernel From 6.19 (inc) to 6.19.10 (exc)
linux linux_kernel From 5.11.1 (inc) to 6.12.78 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-401 The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Impact Analysis

The impact of this vulnerability is a potential memory leak in the Linux kernel's nf_tables subsystem. Over time, this could lead to increased memory usage and possibly degrade system performance or stability, especially under conditions where the cloning failure occurs frequently.

Executive Summary

This vulnerability exists in the Linux kernel's nf_tables component, specifically in the nft_dynset module. It involves a possible memory leak when cloning stateful expressions. If cloning the second stateful expression in an element fails due to GFP_ATOMIC allocation failure, the first stateful expression is not properly released, causing a memory leak.

Detection Guidance

This vulnerability involves a memory leak in the Linux kernel's nf_tables component related to stateful expression cloning failures. Detection would typically involve monitoring kernel logs for related error messages or memory leak indications.

You can check the kernel logs for messages related to nf_tables or softirq processes that might indicate the memory leak. For example, use the following command to search the kernel log:

  • dmesg | grep nf_tables
  • journalctl -k | grep nf_tables

Additionally, monitoring system memory usage and looking for unreferenced objects or unusual memory consumption in the kernel related to nf_tables may help detect the issue.

Mitigation Strategies

The vulnerability has been resolved in the Linux kernel by fixing the memory leak in the nf_tables nft_dynset component. The immediate mitigation step is to update your Linux kernel to a version that includes this fix.

If updating the kernel is not immediately possible, consider limiting or disabling the use of nf_tables features that involve stateful expressions to reduce the risk of triggering the memory leak.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-23399. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart