CVE-2026-23231

HIGH

netfilter: nf_tables: fix use-after-free in nf_tables_addchain()

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2026-23231 has a selected CVSS score of 7.8 (high); EIP currently links 1 catalogued exploit.

Description

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: fix use-after-free in nf_tables_addchain() nf_tables_addchain() publishes the chain to table->chains via list_add_tail_rcu() (in nft_chain_add()) before registering hooks. If nf_tables_register_hook() then fails, the error path calls nft_chain_del() (list_del_rcu()) followed by nf_tables_chain_destroy() with no RCU grace period in between. This creates two use-after-free conditions: 1) Control-plane: nf_tables_dump_chains() traverses table->chains under rcu_read_lock(). A concurrent dump can still be walking the chain when the error path frees it. 2) Packet path: for NFPROTO_INET, nf_register_net_hook() briefly installs the IPv4 hook before IPv6 registration fails. Packets entering nft_do_chain() via the transient IPv4 hook can still be dereferencing chain->blob_gen_X when the error path frees the chain. Add synchronize_rcu() between nft_chain_del() and the chain destroy so that all RCU readers -- both dump threads and in-flight packet evaluation -- have finished before the chain is freed.

Description source: CVE List

Exploitation context

Available material

Catalogued exploits
1

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Jun 16, 2026 · Source: CVE List

Affected products and versions

6
ProductSourceVersion range

Linux

Browse Linux / Linux

Default status: unaffected, affected

CVE List91c7b38dc9f0de4f7f444b796d14476bc12df7bc to < 2a6586ecfa4ce1413daaafee250d2590e05f1a33affected
91c7b38dc9f0de4f7f444b796d14476bc12df7bc to < 7017745068a9068904e1e7a1b170a5785647cc81affected
91c7b38dc9f0de4f7f444b796d14476bc12df7bc to < f3fe58ce37926a10115ede527d59b91bcc05400aaffected
91c7b38dc9f0de4f7f444b796d14476bc12df7bc to < dbd0af8083dd201f07c49110b2ee93710abdff28affected
91c7b38dc9f0de4f7f444b796d14476bc12df7bc to < 2f9a4ffeb763aec822f8ff3d1e82202d27d46d4baffected
91c7b38dc9f0de4f7f444b796d14476bc12df7bc to < 71e99ee20fc3f662555118cf1159443250647533affected
3.16affected
Before 3.16unaffected
6.1.165 to ≤ 6.1.*unaffected
6.6.128 to ≤ 6.6.*unaffected
6.12.75 to ≤ 6.12.*unaffected
6.18.14 to ≤ 6.18.*unaffected
Showing 12 of 14 version ranges

RUGGEDCOM RST2428P

Browse Siemens / RUGGEDCOM RST2428P

Default status: unknown

CVE ListBefore V4.0affected

SIMATIC S7-1500 CPU 1518-4 PN/DP MFP

Browse Siemens / SIMATIC S7-1500 CPU 1518-4 PN/DP MFP

Default status: unknown

CVE ListV3.1.6 to < *affected
V3.1.5 to < *affected

SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP

Browse Siemens / SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP

Default status: unknown

CVE ListV3.1.6 to < *affected
V3.1.5 to < *affected

SIPLUS S7-1500 CPU 1518-4 PN/DP MFP

Browse Siemens / SIPLUS S7-1500 CPU 1518-4 PN/DP MFP

Default status: unknown

CVE ListV3.1.5 to < *affected
V3.1.6 to < *affected

Kernel

Browse Linux / Kernel
OSV3.16.0 to < 6.1.165 · Fixed in 6.1.165affected
6.2.0 to < 6.6.128 · Fixed in 6.6.128affected
6.7.0 to < 6.12.75 · Fixed in 6.12.75affected
6.13.0 to < 6.18.14 · Fixed in 6.18.14affected
6.19.0 to < 6.19.4 · Fixed in 6.19.4affected

Proofs of concept

1

Catalogued exploits

ExploitDBLinux nf_tables 6.19.3 - Local Privilege EscalationExploitDB exploitby aviralyash27Exploit1 file
ExploitDB
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A C exploit targeting CVE-2026-23231, a use-after-free vulnerability in the Linux kernel's nf_tables subsystem. The code triggers the vulnerability by causing a hook registration failure, reclaims the freed memory with a heap spray, attempts to leak kernel addresses via a race condition, and ultimately aims to overwrite modprobe_path for local privilege escalation.

Backdoor review

No backdoor observed in reviewed code

The supplied PoC is a C source file implementing a local privilege escalation exploit for CVE-2026-23231. It uses documented kernel exploitation techniques (UAF, heap spray, payload withheld) to gain root. No concealed backdoor, deceptive payload, or unrelated harmful behavior was observed. The code is self-contained, well-commented, and its actions are consistent with the stated exploit goal.

ClassificationExploit
Model confidence95%
AuthenticationNot required
LanguagesC
Target softwareLinux kernel
Attack typesuse-after-freelocal privilege escalation
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a complete C program that actively triggers CVE-2026-23231, performs heap manipulation, and attempts to gain root privileges. It includes all steps to exploit the vulnerability: triggering the UAF, reclaiming memory, leaking addresses, and escalating privileges. The code's primary purpose is exploitation, not mere detection or analysis.

exploits/linux/local/52549.py:1exploits/linux/local/52549.py:1020-1102exploits/linux/local/52549.py:1204-1296

Requirements

  • Local, unprivileged user access to a vulnerable Linux kernel (3.16 – 6.19.3).exploits/linux/local/52549.py:6
  • Ability to create user and network namespaces (unshare with CLONE_NEWUSER | CLONE_NEWNET).exploits/linux/local/52549.py:646
  • CAP_NET_ADMIN capability within the created namespace to configure nftables.exploits/linux/local/52549.py:644

Observed behavior

  • Checks the running kernel version against a list of vulnerable ranges and exits if patched.exploits/linux/local/52549.py:237-286
  • Creates a new user and network namespace to obtain CAP_NET_ADMIN.exploits/linux/local/52549.py:640-676
  • Sets up nftables infrastructure by creating a table and multiple base chains to prepare the kernel heap.exploits/linux/local/52549.py:974-1018
  • Triggers the use-after-free by applying memory pressure and attempting to create a new base chain, causing a hook registration failure that frees the chain without an RCU grace period.exploits/linux/local/52549.py:1020-1102
  • Sprays the freed kmalloc-256 slot with crafted msg_msg objects to control the contents of the freed nft_base_chain memory.exploits/linux/local/52549.py:1104-1159
  • Starts a concurrent chain dump thread to race against the UAF, attempting to read stale or sprayed data to leak a kernel heap address.exploits/linux/local/52549.py:1161-1202
  • Sets up a modprobe helper payload (payload withheld) and an invalid binary (payload withheld) to attempt privilege escalation via payload withheld.exploits/linux/local/52549.py:787-809
  • Attempts to trigger the modprobe call by executing the invalid binary, which would execute the helper script as root if modprobe_path was successfully overwritten.exploits/linux/local/52549.py:811-829
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

File Creation
Payload withheldCreates a helper script used in the payload withheld technique for privilege escalation. This is a standard part of the exploit, not a backdoor.exploits/linux/local/52549.py:792-798
File Creation
Payload withheldCreates an invalid ELF binary to trigger the kernel's call_usermodehelper, which invokes the overwritten modprobe_path. Standard exploit technique.exploits/linux/local/52549.py:801-806
File Creation
Payload withheldThe modprobe helper script copies /bin/sh to payload withheld and sets the suid bit. This is the intended privilege escalation payload, not a backdoor.exploits/linux/local/52549.py:794-796
Privilege Escalation
Payload withheldThe exploit attempts to overwrite the kernel's modprobe_path variable to execute a user-controlled script as root. This is the documented goal of the PoC.exploits/linux/local/52549.py:1210-1230
Review boundaries

What the analysis did not establish

  • The file extension is .py but the content is C source code, not Python.
  • The exploit's privilege escalation step is incomplete; it acknowledges that a reliable KASLR bypass is not implemented and the payload withheld is not guaranteed to succeed.
  • The analysis is based solely on static code review; the code was not executed, and its actual behavior or reliability cannot be confirmed.
  • Only the single text file (52549.py) was reviewed; no external dependencies or binary files were included in the evidence.
  • The review does not assess the safety or reliability of the exploit code when executed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

References

12