1. Home
  2. Vulnerabilities
  3. CVE-2026-23458
7.8
HIGH CVSS 3.1
CVE-2026-23458
netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct()
Overview
Description

In the Linux kernel, the following vulnerability has been resolved: netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() ctnetlink_dump_exp_ct() stores a conntrack pointer in cb->data for the netlink dump callback ctnetlink_exp_ct_dump_table(), but drops the conntrack reference immediately after netlink_dump_start(). When the dump spans multiple rounds, the second recvmsg() triggers the dump callback which dereferences the now-freed conntrack via nfct_help(ct), leading to a use-after-free on ct->ext. The bug is that the netlink_dump_control has no .start or .done callbacks to manage the conntrack reference across dump rounds. Other dump functions in the same file (e.g. ctnetlink_get_conntrack) properly use .start/.done callbacks for this purpose. Fix this by adding .start and .done callbacks that hold and release the conntrack reference for the duration of the dump, and move the nfct_help() call after the cb->args[0] early-return check in the dump callback to avoid dereferencing ct->ext unnecessarily. BUG: KASAN: slab-use-after-free in ctnetlink_exp_ct_dump_table+0x4f/0x2e0 Read of size 8 at addr ffff88810597ebf0 by task ctnetlink_poc/133 CPU: 1 UID: 0 PID: 133 Comm: ctnetlink_poc Not tainted 7.0.0-rc2+ #3 PREEMPTLAZY Call Trace: <TASK> ctnetlink_exp_ct_dump_table+0x4f/0x2e0 netlink_dump+0x333/0x880 netlink_recvmsg+0x3e2/0x4b0 ? aa_sk_perm+0x184/0x450 sock_recvmsg+0xde/0xf0 Allocated by task 133: kmem_cache_alloc_noprof+0x134/0x440 __nf_conntrack_alloc+0xa8/0x2b0 ctnetlink_create_conntrack+0xa1/0x900 ctnetlink_new_conntrack+0x3cf/0x7d0 nfnetlink_rcv_msg+0x48e/0x510 netlink_rcv_skb+0xc9/0x1f0 nfnetlink_rcv+0xdb/0x220 netlink_unicast+0x3ec/0x590 netlink_sendmsg+0x397/0x690 __sys_sendmsg+0xf4/0x180 Freed by task 0: slab_free_after_rcu_debug+0xad/0x1e0 rcu_core+0x5c3/0x9c0

Details
INFO

Published Date :

April 3, 2026, 4:16 p.m.

Last Modified :

July 24, 2026, 10:10 p.m.

Remotely Exploit :

No

Source :

416baaa9-dc9f-4396-8d5f-8c081fb06d67
Impact
Affected Products

The following products are affected by CVE-2026-23458 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID Vendor Product Action
1 Linux linux_kernel
: Total Affected Vendor : 1 | Products : 1
Scoring
CVSS Scores
The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.
Score Version Severity Vector Exploitability Score Impact Score Source
CVSS 3.1 HIGH 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Solution
Fix use-after-free in netfilter by managing conntrack reference across dump rounds.
  • Add start and done callbacks to manage conntrack reference.
  • Move nfct_help call after early-return check.
  • Apply provided kernel patch.
  • Update Linux kernel.
References
References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2026-23458.

URL Resource
https://git.kernel.org/stable/c/04c8907ce4e3d3e26c5e1a3e47aa5d17082cbb56 Patch
https://git.kernel.org/stable/c/5cb81eeda909dbb2def209dd10636b51549a3f8a Patch
https://git.kernel.org/stable/c/9821b47f669eb82791fa0b1a6ebaf9aa219bea72 Patch
https://git.kernel.org/stable/c/bdf2724eefd4455a66863abb025bab8d3aa98c57 Patch
https://git.kernel.org/stable/c/cd541f15b60e2257441398cf495d978f816d09f8 Patch
https://git.kernel.org/stable/c/d8cd0efbccc5cfb0a80da744a7da76e1333ab925 Patch
https://git.kernel.org/stable/c/f025171feef2ac65663d7986f1d5ff0c28d6b2a9 Patch
https://git.kernel.org/stable/c/f04cc86d59906513d2d62183b882966fc0ae0390 Patch
https://cert-portal.siemens.com/productcert/html/ssa-019113.html
https://cert-portal.siemens.com/productcert/html/ssa-082556.html
CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2026-23458 is associated with the following CWEs:

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2026-23458 weaknesses.

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2026-23458 vulnerability anywhere in the article.

Results are limited to the first 20 news articles due to potential performance issues.

The following table lists the changes that have been made to the CVE-2026-23458 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

  • CVE Translated by [email protected]

    Jul. 24, 2026

    Action Type Old Value New Value
    Added Translation Title: Linux, Description: En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta: netfilter: ctnetlink: corrige uso después de liberación en ctnetlink_dump_exp_ct() ctnetlink_dump_exp_ct() almacena un puntero conntrack en cb -> data para la devolución de llamada de volcado netlink ctnetlink_exp_ct_dump_table(), pero libera la referencia conntrack inmediatamente después de netlink_dump_start(). Cuando el volcado abarca múltiples rondas, el segundo recvmsg() activa la devolución de llamada de volcado que desreferencia el conntrack ahora liberado a través de nfct_help(ct), lo que lleva a un uso después de liberación en ct -> ext. El error es que netlink_dump_control no tiene devoluciones de llamada .start o .done para gestionar la referencia conntrack a través de las rondas de volcado. Otras funciones de volcado en el mismo archivo (p. ej., ctnetlink_get_conntrack) utilizan correctamente las devoluciones de llamada .start/.done para este propósito. Solucione esto añadiendo devoluciones de llamada .start y .done que retienen y liberan la referencia conntrack durante la duración del volcado, y mueva la llamada a nfct_help() después de la comprobación de retorno anticipado cb -> args[0] en la devolución de llamada de volcado para evitar desreferenciar ct -> ext innecesariamente. ERROR: KASAN: uso después de liberación de slab en ctnetlink_exp_ct_dump_table+0x4f/0x2e0 Lectura de tamaño 8 en la dirección ffff88810597ebf0 por la tarea ctnetlink_poc/133 CPU: 1 UID: 0 PID: 133 Comm: ctnetlink_poc No contaminado 7.0.0-rc2+ #3 PREEMPTLAZY Traza de Llamada: <TAREA> ctnetlink_exp_ct_dump_table+0x4f/0x2e0 netlink_dump+0x333/0x880 netlink_recvmsg+0x3e2/0x4b0 ? aa_sk_perm+0x184/0x450 sock_recvmsg+0xde/0xf0 Asignado por la tarea 133: kmem_cache_alloc_noprof+0x134/0x440 __nf_conntrack_alloc+0xa8/0x2b0 ctnetlink_create_conntrack+0xa1/0x900 ctnetlink_new_conntrack+0x3cf/0x7d0 nfnetlink_rcv_msg+0x48e/0x510 netlink_rcv_skb+0xc9/0x1f0 nfnetlink_rcv+0xdb/0x220 netlink_unicast+0x3ec/0x590 netlink_sendmsg+0x397/0x690 __sys_sendmsg+0xf4/0x180 Liberado por la tarea 0: slab_free_after_rcu_debug+0xad/0x1e0 rcu_core+0x5c3/0x9c0
  • CVE Modified by 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e

    Jul. 14, 2026

    Action Type Old Value New Value
    Added Affected [{'vendor': 'Siemens', 'product': 'SIMATIC S7-1500 CPU 1518-4 PN/DP MFP', 'versions': [{'status': 'affected', 'version': 'V3.1.6', 'lessThan': '*', 'versionType': 'custom'}], 'defaultStatus': 'unknown'}, {'vendor': 'Siemens', 'product': 'SIMATIC S7-1500 CPU 1518-4 PN/DP MFP', 'versions': [{'status': 'affected', 'version': 'V3.1.5', 'lessThan': '*', 'versionType': 'custom'}], 'defaultStatus': 'unknown'}, {'vendor': 'Siemens', 'product': 'SIMATIC S7-1500 CPU 1518-4 PN/DP MFP', 'versions': [{'status': 'affected', 'version': 'V3.1.6', 'lessThan': '*', 'versionType': 'custom'}], 'defaultStatus': 'unknown'}, {'vendor': 'Siemens', 'product': 'SIMATIC S7-1500 CPU 1518-4 PN/DP MFP', 'versions': [{'status': 'affected', 'version': 'V3.1.5', 'lessThan': '*', 'versionType': 'custom'}], 'defaultStatus': 'unknown'}, {'vendor': 'Siemens', 'product': 'SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP', 'versions': [{'status': 'affected', 'version': 'V3.1.6', 'lessThan': '*', 'versionType': 'custom'}], 'defaultStatus': 'unknown'}, {'vendor': 'Siemens', 'product': 'SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP', 'versions': [{'status': 'affected', 'version': 'V3.1.5', 'lessThan': '*', 'versionType': 'custom'}], 'defaultStatus': 'unknown'}, {'vendor': 'Siemens', 'product': 'SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP', 'versions': [{'status': 'affected', 'version': 'V3.1.6', 'lessThan': '*', 'versionType': 'custom'}], 'defaultStatus': 'unknown'}, {'vendor': 'Siemens', 'product': 'SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP', 'versions': [{'status': 'affected', 'version': 'V3.1.5', 'lessThan': '*', 'versionType': 'custom'}], 'defaultStatus': 'unknown'}, {'vendor': 'Siemens', 'product': 'SIPLUS S7-1500 CPU 1518-4 PN/DP MFP', 'versions': [{'status': 'affected', 'version': 'V3.1.6', 'lessThan': '*', 'versionType': 'custom'}], 'defaultStatus': 'unknown'}, {'vendor': 'Siemens', 'product': 'SIPLUS S7-1500 CPU 1518-4 PN/DP MFP', 'versions': [{'status': 'affected', 'version': 'V3.1.5', 'lessThan': '*', 'versionType': 'custom'}], 'defaultStatus': 'unknown'}]
    Added Reference https://cert-portal.siemens.com/productcert/html/ssa-019113.html
    Added Reference https://cert-portal.siemens.com/productcert/html/ssa-082556.html
  • CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67

    Jun. 17, 2026

    Action Type Old Value New Value
    Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'e844a928431fa8f1359d1f4f2cef53d9b446bf52', 'lessThan': 'd8cd0efbccc5cfb0a80da744a7da76e1333ab925', 'versionType': 'git'}, {'status': 'affected', 'version': 'e844a928431fa8f1359d1f4f2cef53d9b446bf52', 'lessThan': '9821b47f669eb82791fa0b1a6ebaf9aa219bea72', 'versionType': 'git'}, {'status': 'affected', 'version': 'e844a928431fa8f1359d1f4f2cef53d9b446bf52', 'lessThan': 'bdf2724eefd4455a66863abb025bab8d3aa98c57', 'versionType': 'git'}, {'status': 'affected', 'version': 'e844a928431fa8f1359d1f4f2cef53d9b446bf52', 'lessThan': 'f04cc86d59906513d2d62183b882966fc0ae0390', 'versionType': 'git'}, {'status': 'affected', 'version': 'e844a928431fa8f1359d1f4f2cef53d9b446bf52', 'lessThan': 'f025171feef2ac65663d7986f1d5ff0c28d6b2a9', 'versionType': 'git'}, {'status': 'affected', 'version': 'e844a928431fa8f1359d1f4f2cef53d9b446bf52', 'lessThan': '04c8907ce4e3d3e26c5e1a3e47aa5d17082cbb56', 'versionType': 'git'}, {'status': 'affected', 'version': 'e844a928431fa8f1359d1f4f2cef53d9b446bf52', 'lessThan': 'cd541f15b60e2257441398cf495d978f816d09f8', 'versionType': 'git'}, {'status': 'affected', 'version': 'e844a928431fa8f1359d1f4f2cef53d9b446bf52', 'lessThan': '5cb81eeda909dbb2def209dd10636b51549a3f8a', 'versionType': 'git'}], 'programFiles': ['net/netfilter/nf_conntrack_netlink.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '3.10'}, {'status': 'unaffected', 'version': '0', 'lessThan': '3.10', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.10.253', 'versionType': 'semver', 'lessThanOrEqual': '5.10.*'}, {'status': 'unaffected', 'version': '5.15.203', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.167', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.130', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.78', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.20', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '6.19.10', 'versionType': 'semver', 'lessThanOrEqual': '6.19.*'}, {'status': 'unaffected', 'version': '7.0', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['net/netfilter/nf_conntrack_netlink.c'], 'defaultStatus': 'affected'}]
  • Initial Analysis by [email protected]

    May. 26, 2026

    Action Type Old Value New Value
    Added CWE CWE-416
    Added CPE Configuration OR *cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.2 up to (excluding) 6.6.130 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.11 up to (excluding) 5.15.203 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.16 up to (excluding) 6.1.167 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.7 up to (excluding) 6.12.78 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.13 up to (excluding) 6.18.20 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.19 up to (excluding) 6.19.10 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 3.10 up to (excluding) 5.10.253
    Added Reference Type kernel.org: https://git.kernel.org/stable/c/04c8907ce4e3d3e26c5e1a3e47aa5d17082cbb56 Types: Patch
    Added Reference Type kernel.org: https://git.kernel.org/stable/c/5cb81eeda909dbb2def209dd10636b51549a3f8a Types: Patch
    Added Reference Type kernel.org: https://git.kernel.org/stable/c/9821b47f669eb82791fa0b1a6ebaf9aa219bea72 Types: Patch
    Added Reference Type kernel.org: https://git.kernel.org/stable/c/bdf2724eefd4455a66863abb025bab8d3aa98c57 Types: Patch
    Added Reference Type kernel.org: https://git.kernel.org/stable/c/cd541f15b60e2257441398cf495d978f816d09f8 Types: Patch
    Added Reference Type kernel.org: https://git.kernel.org/stable/c/d8cd0efbccc5cfb0a80da744a7da76e1333ab925 Types: Patch
    Added Reference Type kernel.org: https://git.kernel.org/stable/c/f025171feef2ac65663d7986f1d5ff0c28d6b2a9 Types: Patch
    Added Reference Type kernel.org: https://git.kernel.org/stable/c/f04cc86d59906513d2d62183b882966fc0ae0390 Types: Patch
  • CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67

    Apr. 27, 2026

    Action Type Old Value New Value
    Added CVSS V3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  • CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67

    Apr. 18, 2026

    Action Type Old Value New Value
    Added Reference https://git.kernel.org/stable/c/9821b47f669eb82791fa0b1a6ebaf9aa219bea72
    Added Reference https://git.kernel.org/stable/c/d8cd0efbccc5cfb0a80da744a7da76e1333ab925
  • New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67

    Apr. 03, 2026

    Action Type Old Value New Value
    Added Description In the Linux kernel, the following vulnerability has been resolved: netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() ctnetlink_dump_exp_ct() stores a conntrack pointer in cb->data for the netlink dump callback ctnetlink_exp_ct_dump_table(), but drops the conntrack reference immediately after netlink_dump_start(). When the dump spans multiple rounds, the second recvmsg() triggers the dump callback which dereferences the now-freed conntrack via nfct_help(ct), leading to a use-after-free on ct->ext. The bug is that the netlink_dump_control has no .start or .done callbacks to manage the conntrack reference across dump rounds. Other dump functions in the same file (e.g. ctnetlink_get_conntrack) properly use .start/.done callbacks for this purpose. Fix this by adding .start and .done callbacks that hold and release the conntrack reference for the duration of the dump, and move the nfct_help() call after the cb->args[0] early-return check in the dump callback to avoid dereferencing ct->ext unnecessarily. BUG: KASAN: slab-use-after-free in ctnetlink_exp_ct_dump_table+0x4f/0x2e0 Read of size 8 at addr ffff88810597ebf0 by task ctnetlink_poc/133 CPU: 1 UID: 0 PID: 133 Comm: ctnetlink_poc Not tainted 7.0.0-rc2+ #3 PREEMPTLAZY Call Trace: <TASK> ctnetlink_exp_ct_dump_table+0x4f/0x2e0 netlink_dump+0x333/0x880 netlink_recvmsg+0x3e2/0x4b0 ? aa_sk_perm+0x184/0x450 sock_recvmsg+0xde/0xf0 Allocated by task 133: kmem_cache_alloc_noprof+0x134/0x440 __nf_conntrack_alloc+0xa8/0x2b0 ctnetlink_create_conntrack+0xa1/0x900 ctnetlink_new_conntrack+0x3cf/0x7d0 nfnetlink_rcv_msg+0x48e/0x510 netlink_rcv_skb+0xc9/0x1f0 nfnetlink_rcv+0xdb/0x220 netlink_unicast+0x3ec/0x590 netlink_sendmsg+0x397/0x690 __sys_sendmsg+0xf4/0x180 Freed by task 0: slab_free_after_rcu_debug+0xad/0x1e0 rcu_core+0x5c3/0x9c0
    Added Reference https://git.kernel.org/stable/c/04c8907ce4e3d3e26c5e1a3e47aa5d17082cbb56
    Added Reference https://git.kernel.org/stable/c/5cb81eeda909dbb2def209dd10636b51549a3f8a
    Added Reference https://git.kernel.org/stable/c/bdf2724eefd4455a66863abb025bab8d3aa98c57
    Added Reference https://git.kernel.org/stable/c/cd541f15b60e2257441398cf495d978f816d09f8
    Added Reference https://git.kernel.org/stable/c/f025171feef2ac65663d7986f1d5ff0c28d6b2a9
    Added Reference https://git.kernel.org/stable/c/f04cc86d59906513d2d62183b882966fc0ae0390
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.
CVSS
Vulnerability Scoring Details
Base CVSS Score: 7.8
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact