CVE-2026-23399
Memory Leak in Linux Kernel nf_tables Stateful Expression Handling
Publication date: 2026-03-28
Last updated on: 2026-04-27
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | 5.11 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | From 6.13 (inc) to 6.18.20 (exc) |
| linux | linux_kernel | From 6.19 (inc) to 6.19.10 (exc) |
| linux | linux_kernel | From 5.11.1 (inc) to 6.12.78 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-401 | The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability impact me? :
The impact of this vulnerability is a potential memory leak in the Linux kernel's nf_tables subsystem. Over time, this could lead to increased memory usage and possibly degrade system performance or stability, especially under conditions where the cloning failure occurs frequently.
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's nf_tables component, specifically in the nft_dynset module. It involves a possible memory leak when cloning stateful expressions. If cloning the second stateful expression in an element fails due to GFP_ATOMIC allocation failure, the first stateful expression is not properly released, causing a memory leak.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves a memory leak in the Linux kernel's nf_tables component related to stateful expression cloning failures. Detection would typically involve monitoring kernel logs for related error messages or memory leak indications.
You can check the kernel logs for messages related to nf_tables or softirq processes that might indicate the memory leak. For example, use the following command to search the kernel log:
- dmesg | grep nf_tables
- journalctl -k | grep nf_tables
Additionally, monitoring system memory usage and looking for unreferenced objects or unusual memory consumption in the kernel related to nf_tables may help detect the issue.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability has been resolved in the Linux kernel by fixing the memory leak in the nf_tables nft_dynset component. The immediate mitigation step is to update your Linux kernel to a version that includes this fix.
If updating the kernel is not immediately possible, consider limiting or disabling the use of nf_tables features that involve stateful expressions to reduce the risk of triggering the memory leak.