---
id: CVE-2026-23392
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  netfilter: nf_tables: release flowtable after rcu grace period on error

  Call synchronize_rcu() after unregistering the hooks from error path,
  since a hook that already…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  netfilter: nf_tables: release flowtable after rcu grace period on error

  Call synchronize_rcu() after unregistering the hooks from error path,
  since a hook that already…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-416
vendor: linux
product: linux_kernel
affected:
  - 'linux_kernel >= 4.16.1, < 6.1.167'
  - 'linux_kernel >= 6.2, < 6.6.130'
  - 'linux_kernel >= 6.7, < 6.12.78'
  - 'linux_kernel >= 6.13, < 6.18.20'
  - 'linux_kernel >= 6.19, < 6.19.10'
  - linux_kernel = 4.16
  - linux_kernel = 7.0
patched:
  - linux_kernel 6.19.10
published: '2026-03-25'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T02:18:54.427'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-23392'
references:
  - url: 'https://git.kernel.org/stable/c/7e3955b282eae20d61c75e499c75eade51c20060'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/adee3436ccd29f1e514c028899e400cbc6d84065'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/c8092edb9a11f20f95ccceeb9422b7dd0df337bd'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/d2632de96ccb066e0131ad1494241b9c281c60b8'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/d73f4b53aaaea4c95f245e491aa5eeb8a21874ce'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/e78a2dcc7cfb87b64a631441ca7681492b347ef6'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-019113.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-082556.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-457936.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-784472.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
tags:
  - nvd
  - cve.org
epss: 0.00165
epssPercentile: 0.05715
ingestedAt: '2026-09-08T15:33:26.992Z'
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T15:07:35.820469Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_tables: release flowtable after rcu grace period on error

Call synchronize_rcu() after unregistering the hooks from error path,
since a hook that already refers to this flowtable can be already
registered, exposing this flowtable to packet path and nfnetlink_hook
control plane.

This error path is rare, it should only happen by reaching the maximum
number hooks or by failing to set up to hardware offload, just call
synchronize_rcu().

There is a check for already used device hooks by different flowtable
that could result in EEXIST at this late stage. The hook parser can be
updated to perform this check earlier to this error path really becomes
rarely exercised.

Uncovered by KASAN reported as use-after-free from nfnetlink_hook path
when dumping hooks.

## Affected

- `linux_kernel >= 4.16.1, < 6.1.167`
- `linux_kernel >= 6.2, < 6.6.130`
- `linux_kernel >= 6.7, < 6.12.78`
- `linux_kernel >= 6.13, < 6.18.20`
- `linux_kernel >= 6.19, < 6.19.10`
- `linux_kernel = 4.16`
- `linux_kernel = 7.0`

## Remediation

Upgrade past the affected range:

- `linux_kernel 6.19.10`