Loading vulnerability…
Use-after-free in Linux kernel netfilter BPF hook handling
CVE-2026-23412 is a use-after-free vulnerability in the Linux kernel's BPF netfilter link implementation. The bpf_nf_link_lops structure uses synchronous .dealloc handling, causing bpf_nf_link_dealloc() to free a link before concurrent RCU readers finish accessing its hook data. Concurrent BPF link destruction and hook enumeration through nfnetlink_hooks can consequently produce an invalid read in nfnl_hook_dump_one(). KASAN testing reproduced an eight-byte read from freed memory and a kernel panic. Local privilege escalation through heap reclamation and function-pointer hijacking has also been claimed. The affected component was introduced in Linux 6.4-rc1; the upstream fix replaces .dealloc with .dealloc_deferred to postpone freeing until RCU readers complete.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
The vulnerability permits access to freed kernel memory during concurrent netfilter BPF link destruction and hook enumeration. Testing demonstrated a slab-use-after-free and kernel panic, establishing an availability impact. Local privilege escalation through attacker-controlled slab reclamation and function-pointer hijacking has been claimed, but successful privilege escalation is not demonstrated in the available technical details. Specific confidentiality consequences are not established.
If you can’t patch tonight, do this now.
If immediate patching is not possible, reduce exposure by restricting local access to trusted administrators only and limiting the ability to create and manipulate BPF netfilter links. In practice this means minimizing or removing CAP_BPF and CAP_NET_ADMIN from untrusted users, containers, and services; disabling or tightly controlling unprivileged BPF usage where supported; and avoiding unnecessary exposure of interfaces that permit nfnetlink hook enumeration or BPF netfilter link management to less-trusted local principals. These are compensating controls only; the definitive mitigation is to install a fixed kernel.
Patch, then assume compromise.
Install a vendor-supported kernel update containing the change from .dealloc to .dealloc_deferred in bpf_nf_link_lops, ensuring link memory is released only after an RCU grace period. The upstream fix is identified as included in Linux 7.0-rc5. For Google COS, update the csql-kernel-6_6 and related packages to 18613.534.62 or later, or the cchost-kernel-6_12 and related packages to 19506.120.44 or later, as applicable. SUSE fixes include kernel-default 6.4.0-41.1 or later for Linux Micro 6.0/6.1, 6.4.0-150600.23.95.1 or later for SLES 15 SP6-LTSS, and 6.4.0-150700.53.55.1 or later for SLE Desktop 15 SP7. Apply the appropriate distribution security update and reboot into the patched kernel.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.