CVE-2026-23412

EUVD-2026-18190

02.04.2026, 12:16

In the Linux kernel, the following vulnerability has been resolved:

netfilter: bpf: defer hook memory release until rcu readers are done

Yiming Qian reports UaF when concurrent process is dumping hooks via
nfnetlink_hooks:

BUG: KASAN: slab-use-after-free in nfnl_hook_dump_one.isra.0+0xe71/0x10f0
Read of size 8 at addr ffff888003edbf88 by task poc/79
Call Trace:
 <TASK>
 nfnl_hook_dump_one.isra.0+0xe71/0x10f0
 netlink_dump+0x554/0x12b0
 nfnl_hook_get+0x176/0x230
 [..]

Defer release until after concurrent readers have completed.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	7.8 HIGH	LOCAL	LOW	LOW	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 1%

Affected Products (NVD)

Vendor	Product	Version
linux	linux_kernel	6.4.1 ≤ 𝑥 < 6.6.130
linux	linux_kernel	6.7 ≤ 𝑥 < 6.12.78
linux	linux_kernel	6.13 ≤ 𝑥 < 6.18.20
linux	linux_kernel	6.19 ≤ 𝑥 < 6.19.10
linux	linux_kernel	6.4
linux	linux_kernel	7.0:rc1
linux	linux_kernel	7.0:rc2
linux	linux_kernel	7.0:rc3
linux	linux_kernel	7.0:rc4
linux	linux_kernel	7.0:rc5
linux	linux_kernel	7.0:rc6
linux	linux_kernel	7.0:rc7

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

linux

bookworm	6.1.170-3 fixed
bookworm (security)	6.1.176-1 fixed
bullseye	5.10.223-1 fixed
bullseye (security)	5.10.259-1 fixed
forky	7.0.13-1 fixed
sid	7.0.14-1 fixed
trixie	6.12.86-1 fixed
trixie (security)	6.12.94-1 fixed

openSUSE / SLES Releases

openSUSE Product

Release

cluster-md-kmp-default

suse enterprise server 15 SP6

6.4.0-150600.23.95.1

fixed

dlm-kmp-default

suse enterprise server 15 SP6

6.4.0-150600.23.95.1

fixed

gfs2-kmp-default

suse enterprise server 15 SP6

6.4.0-150600.23.95.1

fixed

kernel-64kb

suse enterprise desktop 15 SP7	6.4.0-150700.53.55.1 fixed
suse enterprise sap 15 SP7	6.4.0-150700.53.55.1 fixed
suse enterprise server 15 SP6	6.4.0-150600.23.95.1 fixed
suse enterprise server 15 SP7	6.4.0-150700.53.55.1 fixed

kernel-default

suse enterprise desktop 15 SP7	6.4.0-150700.53.55.1 fixed
suse enterprise sap 15 SP7	6.4.0-150700.53.55.1 fixed
suse enterprise server 15 SP6	6.4.0-150600.23.95.1 fixed
suse enterprise server 15 SP7	6.4.0-150700.53.55.1 fixed

kernel-default-base

suse enterprise desktop 15 SP7	6.4.0-150700.53.55.1.150700.17.33.1 fixed
suse enterprise sap 15 SP7	6.4.0-150700.53.55.1.150700.17.33.1 fixed
suse enterprise server 15 SP6	6.4.0-150600.23.95.1.150600.12.44.1 fixed
suse enterprise server 15 SP7	6.4.0-150700.53.55.1.150700.17.33.1 fixed

kernel-obs-build

suse enterprise desktop 15 SP7	6.4.0-150700.53.55.1 fixed
suse enterprise sap 15 SP7	6.4.0-150700.53.55.1 fixed
suse enterprise server 15 SP6	6.4.0-150600.23.95.1 fixed
suse enterprise server 15 SP7	6.4.0-150700.53.55.1 fixed

kernel-source

suse enterprise desktop 15 SP7	6.4.0-150700.53.55.1 fixed
suse enterprise sap 15 SP7	6.4.0-150700.53.55.1 fixed
suse enterprise server 15 SP6	6.4.0-150600.23.95.1 fixed
suse enterprise server 15 SP7	6.4.0-150700.53.55.1 fixed

kernel-zfcpdump

suse enterprise desktop 15 SP7	6.4.0-150700.53.55.1 fixed
suse enterprise sap 15 SP7	6.4.0-150700.53.55.1 fixed
suse enterprise server 15 SP6	6.4.0-150600.23.95.1 fixed
suse enterprise server 15 SP7	6.4.0-150700.53.55.1 fixed

ocfs2-kmp-default

suse enterprise server 15 SP6

6.4.0-150600.23.95.1

fixed

reiserfs-kmp-default

suse enterprise server 15 SP6

6.4.0-150600.23.95.1

fixed

Amazon Linux Releases

Amazon Package

Release

bpftool6.12

Amazon Linux 2023

1:6.12.79-101.147.amzn2023

fixed

bpftool6.12-debuginfo

Amazon Linux 2023

1:6.12.79-101.147.amzn2023

fixed

bpftool6.18

Amazon Linux 2023

1:6.18.20-20.229.amzn2023

fixed

bpftool6.18-debuginfo

Amazon Linux 2023

1:6.18.20-20.229.amzn2023

fixed

kernel-livepatch-6.12.79-101.147

Amazon Linux 2023

1:1.0-0.amzn2023

fixed

kernel-livepatch-6.18.20-20.229

Amazon Linux 2023

1:1.0-0.amzn2023

fixed

kernel6.12

Amazon Linux 2023

1:6.12.79-101.147.amzn2023

fixed

kernel6.12-debuginfo

Amazon Linux 2023

1:6.12.79-101.147.amzn2023

fixed

kernel6.12-debuginfo-common-aarch64

Amazon Linux 2023

1:6.12.79-101.147.amzn2023

fixed

kernel6.12-debuginfo-common-x86_64

Amazon Linux 2023

1:6.12.79-101.147.amzn2023

fixed

kernel6.12-devel

Amazon Linux 2023

1:6.12.79-101.147.amzn2023

fixed

kernel6.12-headers

Amazon Linux 2023

1:6.12.79-101.147.amzn2023

fixed

kernel6.12-libbpf

Amazon Linux 2023

1:6.12.79-101.147.amzn2023

fixed

kernel6.12-libbpf-debuginfo

Amazon Linux 2023

1:6.12.79-101.147.amzn2023

fixed

kernel6.12-libbpf-devel

Amazon Linux 2023

1:6.12.79-101.147.amzn2023

fixed

kernel6.12-libbpf-static

Amazon Linux 2023

1:6.12.79-101.147.amzn2023

fixed

kernel6.12-modules-extra

Amazon Linux 2023

1:6.12.79-101.147.amzn2023

fixed

kernel6.12-modules-extra-common

Amazon Linux 2023

1:6.12.79-101.147.amzn2023

fixed

kernel6.12-tools

Amazon Linux 2023

1:6.12.79-101.147.amzn2023

fixed

kernel6.12-tools-debuginfo

Amazon Linux 2023

1:6.12.79-101.147.amzn2023

fixed

kernel6.12-tools-devel

Amazon Linux 2023

1:6.12.79-101.147.amzn2023

fixed

kernel6.18

Amazon Linux 2023

1:6.18.20-20.229.amzn2023

fixed

kernel6.18-debuginfo

Amazon Linux 2023

1:6.18.20-20.229.amzn2023

fixed

kernel6.18-debuginfo-common-aarch64

Amazon Linux 2023

1:6.18.20-20.229.amzn2023

fixed

kernel6.18-debuginfo-common-x86_64

Amazon Linux 2023

1:6.18.20-20.229.amzn2023

fixed

kernel6.18-devel

Amazon Linux 2023

1:6.18.20-20.229.amzn2023

fixed

kernel6.18-headers

Amazon Linux 2023

1:6.18.20-20.229.amzn2023

fixed

kernel6.18-libbpf

Amazon Linux 2023

1:6.18.20-20.229.amzn2023

fixed

kernel6.18-libbpf-debuginfo

Amazon Linux 2023

1:6.18.20-20.229.amzn2023

fixed

kernel6.18-libbpf-devel

Amazon Linux 2023

1:6.18.20-20.229.amzn2023

fixed

kernel6.18-libbpf-static

Amazon Linux 2023

1:6.18.20-20.229.amzn2023

fixed

kernel6.18-modules-extra

Amazon Linux 2023

1:6.18.20-20.229.amzn2023

fixed

kernel6.18-modules-extra-common

Amazon Linux 2023

1:6.18.20-20.229.amzn2023

fixed

kernel6.18-tools

Amazon Linux 2023

1:6.18.20-20.229.amzn2023

fixed

kernel6.18-tools-debuginfo

Amazon Linux 2023

1:6.18.20-20.229.amzn2023

fixed

kernel6.18-tools-devel

Amazon Linux 2023

1:6.18.20-20.229.amzn2023

fixed

perf6.12

Amazon Linux 2023

1:6.12.79-101.147.amzn2023

fixed

perf6.12-debuginfo

Amazon Linux 2023

1:6.12.79-101.147.amzn2023

fixed

perf6.18

Amazon Linux 2023

1:6.18.20-20.229.amzn2023

fixed

perf6.18-debuginfo

Amazon Linux 2023

1:6.18.20-20.229.amzn2023

fixed

python3-perf6.12

Amazon Linux 2023

1:6.12.79-101.147.amzn2023

fixed

python3-perf6.12-debuginfo

Amazon Linux 2023

1:6.12.79-101.147.amzn2023

fixed

python3-perf6.18

Amazon Linux 2023

1:6.18.20-20.229.amzn2023

fixed

python3-perf6.18-debuginfo

Amazon Linux 2023

1:6.18.20-20.229.amzn2023

fixed

Common Weakness Enumeration

CWE-416 - Use After Free
Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code.

Vulnerability Media Exposure

[GERMAN] Linux Kernel: Mehrere Schwachstellen
Ein Angreifer kann mehrere Schwachstellen in Linux Kernel ausnutzen, um unter anderem einen Denial of Service-Angriff auszuführen oder um Sicherheitsmechanismen zu umgehen.
Published: 2026-04-06T22:00:00+00:00

References

https://git.kernel.org/stable/c/24f90fa3994b992d1a09003a3db2599330a5232a

https://git.kernel.org/stable/c/54244d54a971c26a0cd0a9073460ff71f3c51b32

https://git.kernel.org/stable/c/c25e0dec366ae99b7264324ce3c7cbaea34691f9

https://git.kernel.org/stable/c/cb2bf5efdb02a2a59faf603604a1066e8266f349

https://git.kernel.org/stable/c/d016c216bc75c45128160593a77b864a04dbe7c0