CVE-2026-23278

HighCVSS 7.8/10Last modified Oct 30, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_tables: always walk all pending catchall elements

During transaction processing we might have more than one catchall element: 1 live catchall element and 1 pending element that is coming as part of the new batch.

If the map holding the catchall elements is also going away, its required to toggle all catchall elements and not just the first viable candidate.

Otherwise, we get: WARNING: ./include/net/netfilter/nf_tables.h:1281 at nft_data_release+0xb7/0xe0 [nf_tables], CPU#2: nft/1404 RIP: 0010:nft_data_release+0xb7/0xe0 [nf_tables] [..] __nft_set_elem_destroy+0x106/0x380 [nf_tables] nf_tables_abort_release+0x348/0x8d0 [nf_tables] nf_tables_abort+0xcf2/0x3ac0 [nf_tables] nfnetlink_rcv_batch+0x9c9/0x20e0 [..]

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

VendorProductVersions
LinuxLinux>= 25aa2ad37c2162be1c0bc4fe6397f7e4c13f00f8, < ae8f3cedc5f5653a5bed45c5ed016fe156e2af55; >= d60be2da67d172aecf866302c91ea11533eca4d9, < c4d4e86fda707d89eaba80e343321737375f8582; >= 628bd3e49cba1c066228e23d71a852c23e26da73, < 4830fb44d12f586f3f544609e086933649a9175a; >= 628bd3e49cba1c066228e23d71a852c23e26da73, < eb0948fa13298212c5f8b30ee48efdae4389ab09; >= 628bd3e49cba1c066228e23d71a852c23e26da73, < de47a88c6b807910f05703fb6605f7efdaa11417; >= 628bd3e49cba1c066228e23d71a852c23e26da73, < 77c26b5056d693ffe5e9f040e946251cdb55ae55; >= 628bd3e49cba1c066228e23d71a852c23e26da73, < 7cb9a23d7ae40a702577d3d8bacb7026f04ac2a9; bc9f791d2593f17e39f87c6e2b3a36549a3705b1; 3c7ec098e3b588434a8b07ea9b5b36f04cef1f50; a136b7942ad2a50de708f76ea299ccb45ac7a7f9; dc7cdf8cbcbf8b13de1df93f356ec04cdeef5c41; >= 5.15.121, < 5.15.224; >= 6.1.36, < 6.1.177; >= 4.19.316, < 4.20; >= 5.4.262, < 5.5; >= 5.10.188, < 5.11; >= 6.3.10, < 6.4
LinuxLinux6.4
SiemensSIMATIC S7-1500 TM MFP - GNU/Linux subsystem< *

References

Timeline

Published
Mar 20, 2026
Last modified
Oct 30, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-232795.5In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix NULL pointer dereference in mesh_rx_csa_frame() InCVE-2026-23287.5An unauthenticated remote attacker can exploit insufficient input validation to access backend components beyond their intended scope via paCVE-2026-232807.8In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Prevent ubuf size overflow The ubuf size calculation maCVE-2026-232817.8In the Linux kernel, the following vulnerability has been resolved: wifi: libertas: fix use-after-free in lbs_free_adapter() The lbs_free_CVE-2026-232825.5In the Linux kernel, the following vulnerability has been resolved: smb: client: fix oops due to uninitialised var in smb2_unlink() If SMBCVE-2026-232835.5In the Linux kernel, the following vulnerability has been resolved: regulator: fp9931: Fix PM runtime reference leak in fp9931_hwmon_read()CVE-2026-232845.5In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: Reset prog ptr to old_prog in case of errorCVE-2026-232855.5In the Linux kernel, the following vulnerability has been resolved: drbd: fix null-pointer dereference on local read error In drbd_requestCVE-2026-232865.5In the Linux kernel, the following vulnerability has been resolved: atm: lec: fix null-ptr-deref in lec_arp_clear_vccs syzkaller reported CVE-2026-232875.5In the Linux kernel, the following vulnerability has been resolved: irqchip/sifive-plic: Fix frozen interrupt due to affinity setting PLICCVE-2026-232887.8In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Fix out-of-bounds memset in command slot handling The rCVE-2026-232895.5In the Linux kernel, the following vulnerability has been resolved: IB/mthca: Add missed mthca_unmap_user_db() for mthca_create_srq() Fix
CVE-2026-23278: High severity, CVSS 7.8 | Vulnix