Linux Kernel Netfilter nf_tables Use-After-Free Vulnerability

Publication date: 2026-06-24

Last updated on: 2026-07-14

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase Publish new hooks in the list into the basechain/flowtable using splice_list_rcu() to ensure netlink dump list traversal via rcu is safe while concurrent ruleset update is going on.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-24

Last Modified

2026-07-14

Generated

2026-07-15

AI Q&A

2026-06-24

EPSS Evaluated

2026-07-13

NVD

CVE-2026-52988

EUVD

EUVD-2026-38856

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	7.1
linux	linux_kernel	From 5.8 (inc) to 7.0.10 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Impact Analysis

This vulnerability in the Linux kernel's netfilter nf_tables component involves the handling of hook lists during concurrent ruleset updates. If exploited, it could potentially cause unsafe traversal of netlink dump lists, which might lead to system instability or unexpected behavior in network filtering operations.

Executive Summary

This vulnerability is related to the Linux kernel's netfilter subsystem, specifically the nf_tables component. It involves the process of joining the hook list using the function splice_list_rcu() during the commit phase. The fix ensures that new hooks are published into the basechain or flowtable safely using splice_list_rcu(), which allows netlink dump list traversal via RCU (Read-Copy-Update) to be safe even when concurrent ruleset updates are occurring.

Hi! I’m here to help you understand CVE-2026-52988. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70