CVE-2026-72435
Received Received - Intake

BaseFortify

Publication date: 2026-08-15

Last updated on: 2026-08-15

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: fix order of kfree_rcu() and rcu_assign_pointer() Sashiko pointed out that kfree_rcu() was called before rcu_assign_pointer() in handling the comment extension. Fix the order so that rcu_assign_pointer() called first.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-15
Last Modified
2026-08-15
Generated
2026-08-15
AI Q&A
2026-08-15
EPSS Evaluated
N/A
NVD
CVE-2026-72435
EUVD
EUVD-2026-59334

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
netfilter ipset *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a race condition in the netfilter ipset subsystem. The issue occurs when kfree_rcu() is called before rcu_assign_pointer(), which could lead to use-after-free errors or memory corruption due to improper memory management in the RCU (Read-Copy-Update) mechanism.

Detection Guidance

This vulnerability is specific to the Linux kernel's netfilter ipset module and involves a race condition in RCU (Read-Copy-Update) pointer handling. Detection requires checking kernel logs for related errors or kernel crashes after ipset operations. Commands like dmesg | grep ipset or journalctl -k | grep ipset may help identify issues. Ensure your kernel version includes the fix.

Impact Analysis

This vulnerability could allow an attacker to cause a denial-of-service condition or potentially execute arbitrary code with kernel privileges. It may lead to system crashes, data corruption, or unauthorized access if exploited.

Mitigation Strategies

Update your Linux kernel to a version that includes the fix for this vulnerability. Check your distribution's security advisories for the patched kernel version. If immediate patching is not possible, avoid using ipset with comment extensions until the update is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72435. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart