CVE-2026-23391

HighCVSS 7.8/10Last modified Nov 10, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: xt_CT: drop pending enqueued packets on template removal

Templates refer to objects that can go away while packets are sitting in nfqueue refer to:

- helper, this can be an issue on module removal. - timeout policy, nfnetlink_cttimeout might remove it.

The use of templates with zone and event cache filter are safe, since this just copies values.

Flush these enqueued packets in case the template rule gets removed.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

VendorProductVersions
LinuxLinux>= 24de58f465165298aaa8f286b2592f0163706cfe, < 55445134d42b84cb0a272e42c98d233ca65eca83; >= 24de58f465165298aaa8f286b2592f0163706cfe, < cc57506dd66555899560b9c0f24e813f034e12ec; >= 24de58f465165298aaa8f286b2592f0163706cfe, < d2d0bae0c9a2a17b6990a2966f5cdce0813d6256; >= 24de58f465165298aaa8f286b2592f0163706cfe, < 63b8097cea1923fe82cd598068d0796da8c015ec; >= 24de58f465165298aaa8f286b2592f0163706cfe, < 19a230dec6bb8928e3f96387f9085cf2c79bcef9; >= 24de58f465165298aaa8f286b2592f0163706cfe, < cb549925875fa06dd155e49db4ac2c5044c30f9c; >= 24de58f465165298aaa8f286b2592f0163706cfe, < 777d02efe3d630cca4c1b63962cec17c57711325; >= 24de58f465165298aaa8f286b2592f0163706cfe, < f62a218a946b19bb59abdd5361da85fa4606b96b
LinuxLinux3.4
SiemensSIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)>= V3.1.6, < *
SiemensSIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)>= V3.1.5, < *
SiemensSIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)>= V3.1.7, < *
SiemensSIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)>= V3.1.6, < *
SiemensSIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)>= V3.1.5, < *
SiemensSIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)>= V3.1.7, < *
SiemensSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)>= V3.1.6, < *
SiemensSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)>= V3.1.5, < *
SiemensSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)>= V3.1.7, < *
SiemensSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)>= V3.1.6, < *
SiemensSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)>= V3.1.5, < *
SiemensSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)>= V3.1.7, < *
SiemensSIMATIC S7-1500 TM MFP - GNU/Linux subsystem< *
SiemensSIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)>= V3.1.6, < *
SiemensSIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)>= V3.1.5, < *
SiemensSIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)>= V3.1.7, < *

References

Timeline

Published
Mar 25, 2026
Last modified
Nov 10, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-233927.8In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: release flowtable after rcu grace period on errorCVE-2026-233937.8In the Linux kernel, the following vulnerability has been resolved: bridge: cfm: Fix race condition in peer_mep deletion When a peer MEP iCVE-2026-233944.7In the Linux kernel, the following vulnerability has been resolved: af_unix: Give up GC if MSG_PEEK intervened. Igor Ushakov reported thatCVE-2026-233958.8In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ CurrentlCVE-2026-233965.5In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix NULL deref in mesh_matches_local() mesh_matches_loCVE-2026-233977.1In the Linux kernel, the following vulnerability has been resolved: nfnetlink_osf: validate individual option lengths in fingerprints nfnlCVE-2026-233985.5In the Linux kernel, the following vulnerability has been resolved: icmp: fix NULL pointer dereference in icmp_tag_validation() icmp_tag_vCVE-2026-233995.5In the Linux kernel, the following vulnerability has been resolved: nf_tables: nft_dynset: fix possible stateful expression memleak in erroCVE-2026-23406.5A flaw was found in Samba’s vfs_worm module. The module is intended to provide write-once, read-many (WORM) protections by preventing modifiCVE-2026-234005.5In the Linux kernel, the following vulnerability has been resolved: rust_binder: call set_notification_done() without proc lock Consider tCVE-2026-234015.5In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIOCVE-2026-234025.5In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Only WARN in direct MMUs when overwriting shadow-present
CVE-2026-23391: High severity, CVSS 7.8 | Vulnix