LiveActive security incident?Get immediate response
CVE Record

CVE-2026-23458: netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct()

In the Linux kernel, the following vulnerability has been resolved: netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() ctnetlink_dump_exp_ct() stores a conntrack pointer in cb->data for the netlink dump callback ctnetlink_exp_ct_dump_table(), but drops the conntrack reference immediately after netlink_dump_start(). When the dump spans multiple rounds, the second recvmsg() triggers the dump callback which dereferences the now-freed conntrack via nfct_help(ct), leading to a use-after-free on ct->ext. The bug is that the netlink_dump_control has no .start or .done callbacks to manage the conntrack reference across dump rounds. Other dump functions in the same file (e.g. ctnetlink_get_conntrack) properly use .start/.done callbacks for this purpose. Fix this by adding .start and .done callbacks that hold and release the conntrack reference for the duration of the dump, and move the nfct_help() call after the cb->args[0] early-return check in the dump callback to avoid dereferencing ct->ext unnecessarily. BUG: KASAN: slab-use-after-free in ctnetlink_exp_ct_dump_table+0x4f/0x2e0 Read of size 8 at addr ffff88810597ebf0 by task ctnetlink_poc/133 CPU: 1 UID: 0 PID: 133 Comm: ctnetlink_poc Not tainted 7.0.0-rc2+ #3 PREEMPTLAZY Call Trace: <TASK> ctnetlink_exp_ct_dump_table+0x4f/0x2e0 netlink_dump+0x333/0x880 netlink_recvmsg+0x3e2/0x4b0 ? aa_sk_perm+0x184/0x450 sock_recvmsg+0xde/0xf0 Allocated by task 133: kmem_cache_alloc_noprof+0x134/0x440 __nf_conntrack_alloc+0xa8/0x2b0 ctnetlink_create_conntrack+0xa1/0x900 ctnetlink_new_conntrack+0x3cf/0x7d0 nfnetlink_rcv_msg+0x48e/0x510 netlink_rcv_skb+0xc9/0x1f0 nfnetlink_rcv+0xdb/0x220 netlink_unicast+0x3ec/0x590 netlink_sendmsg+0x397/0x690 __sys_sendmsg+0xf4/0x180 Freed by task 0: slab_free_after_rcu_debug+0xad/0x1e0 rcu_core+0x5c3/0x9c0

HighCVSS 7.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A flaw in Linux’s network connection-tracking code can cause the kernel to reuse memory after it has been freed. A low-privileged local user may be able to trigger the condition, potentially crashing the system or compromising data and system integrity. This is a local, not remotely reachable, vulnerability according to the supplied CVSS vector.

Executive priority

Treat this as a high-priority kernel maintenance issue, especially on shared or sensitive Linux systems permitting low-privileged local access. It does not warrant the same emergency response as a confirmed remotely exploited flaw, but patch planning should begin promptly because the stated impact covers complete confidentiality, integrity, and availability compromise.

Technical view

ctnetlink_dump_exp_ct() released a conntrack reference immediately after starting a netlink dump, while retaining its pointer for later callback rounds. A subsequent receive operation could dereference the freed object through nfct_help(ct). The stable fixes add start and done callbacks to retain the reference throughout the dump and avoid an unnecessary early dereference.

Likely exposure

Potential exposure exists on systems running affected Linux kernels where a low-privileged local user can access the relevant netfilter conntrack netlink functionality. The supplied version list is flattened and ambiguous, so exact affected and corrected distribution package versions cannot be established from this bundle alone. Vendor-specific mapping is required.

Exploitation context

The CVSS assessment is 7.8 with local access, low complexity, low privileges, and no user interaction. The supplied record is not in KEV and provides no evidence of active exploitation. Its KASAN trace demonstrates reproducibility under testing but does not establish public weaponization or real-world abuse.

Researcher notes

The failure concerns reference lifetime across multi-round netlink dumps. Reviewers should verify both reference acquisition and release callbacks and the reordered nfct_help() access. Multiple stable-tree commits are supplied, indicating branch-specific fixes. Siemens advisories are referenced, but their contents are absent, so no Siemens product exposure or remediation claim can be made here.

Mitigation direction

  • Apply a vendor-supplied kernel update incorporating the applicable Linux stable fix or backport.
  • Check distribution and appliance vendor advisories for corrected package versions before deployment.
  • Until patched, reduce untrusted local account access on affected systems where operationally feasible.
  • Prioritize high-value and shared systems because successful exploitation could affect confidentiality, integrity, and availability.

Validation and detection

  • Inventory running kernel versions and compare them with authoritative vendor advisories and the CVE record.
  • Confirm the installed kernel package includes the applicable stable fix commit or vendor backport.
  • After updating, verify the corrected kernel is running following any required reboot.
  • Use authorized non-production regression testing to confirm multi-round conntrack expectation dumps no longer cause memory-safety faults.
Prepared
Confidence
medium
Sources
10

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-23458 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
1ADP providers
11Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.8CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9Linux

Vulnerability scoring details

Base CVSS 3.1 score

7.8High
CVSS 3.1 vector shape for CVE-2026-23458Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

siemens-SADPADP container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxe844a928431fa8f1359d1f4f2cef53d9b446bf52, e844a928431fa8f1359d1f4f2cef53d9b446bf52, e844a928431fa8f1359d1f4f2cef53d9b446bf52, e844a928431fa8f1359d1f4f2cef53d9b446bf52, e844a928431fa8f1359d1f4f2cef53d9b446bf52, e844a928431fa8f1359d1f4f2cef53d9b446bf52, e844a928431fa8f1359d1f4f2cef53d9b446bf52, e844a928431fa8f1359d1f4f2cef53d9b446bf52unaffected
LinuxLinux3.10, 0, 5.10.253, 5.15.203, 6.1.167, 6.6.130, 6.12.78, 6.18.20, 6.19.10, 7.0affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.