Description

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: make nft_object rhltable per table The nft_object rhltable is global, this allows for accessing objects that are being dismangled from lookup path by other existing netns. Given the nft_obj_destroy() releases the object inmediately, this might lead to use-after-free of these objects that are being released. Make the existing rhltable per table to address this issue to deal with with the nft_rcv_nl_event() path too. Update nft_obj_lookup() to take the table as non-const, otherwise, compiler complains when passing the objname_ht to rhltable_lookup().

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-08-15T13:18:02.013Z",
  "pubdate": "2026-08-15T13:18:02.013Z",
  "executiveSummary": "A vulnerability has been identified in the Linux kernel netfilter subsystem, specifically within the nf_tables component, involving state management of stateful objects.\nThe vulnerability type is a use-after-free condition arising from improper resource scoping and cross-namespace object visibility during concurrent lookup and destruction operations.\nThe impact of this flaw includes potential kernel memory corruption, denial of service, and possible local privilege escalation for an attacker capable of executing arbitrary code or manipulating netfilter rules.\nAffected systems include Linux kernel deployments utilizing the netfilter nf_tables framework where stateful objects are managed globally rather than per-table.\nRisk implications are significant due to the core kernel context of the netfilter subsystem, allowing unauthorized memory access if exploitation conditions are met.\nAttacker capabilities require local access with permissions to interact with netfilter tables and netlink events, enabling the triggering of asynchronous destruction and lookup paths.\nExploitation requirements include triggering the race condition between `nft_obj_destroy()` and the `nft_rcv_nl_event()` path while objects are being dismantled from the lookup path across network namespaces.",
  "technicalDetails": "The root cause of the vulnerability stems from the global scoping of the `nft_object` rhltable within the nf_tables subsystem of the Linux kernel.\nBecause the rhltable was global, it permitted concurrent access to stateful objects that were actively being dismantled from the lookup path by other existing network namespaces.\nSpecifically, when `nft_obj_destroy()` is invoked, it immediately releases the targeted object from memory.\nHowever, due to the global nature of the hash table, concurrent lookup operations via paths such as `nft_rcv_nl_event()` can still access the memory address of the object after it has been deallocated.\nThis leads directly to a use-after-free condition within the kernel address space.\nThe vulnerable component is the `nft_object` lookup and storage mechanism handled by `nft_obj_lookup()` and the global `objname_ht` structure.\nDuring exploitation, an attacker induces a state where an object is marked for destruction or is actively being released while a parallel netlink event or lookup operation queries the global rhltable.\nBecause the object is freed immediately without proper synchronization or per-table isolation, the subsequent reference to the stale pointer results in memory corruption.\nAuthentication requirements depend on the capability to interact with the network namespace and configure nf_tables rules, typically requiring administrative privileges or specific netfilter capabilities within a namespace.\nPrivilege requirements involve local execution context with sufficient permissions to create and manipulate nf_tables rulesets and generate netlink traffic.\nNetwork exposure is restricted to the local system boundary or container boundary depending on network namespace isolation, as netfilter rules and netlink events are processed locally.\nPost-exploitation impact includes destabilization of the Linux kernel, system crashes resulting in denial of service, or the theoretical execution of arbitrary code with kernel-level privileges."
}