CVE-2026-74565 (GCVE-0-2026-74565)

Vulnerability from cvelistv5 – Published: 2026-08-15 12:28 – Updated: 2026-09-14 11:58
VLAI
Title
netfilter: nf_tables: make nft_object rhltable per table
Summary
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: make nft_object rhltable per table The nft_object rhltable is global, this allows for accessing objects that are being dismangled from lookup path by other existing netns. Given the nft_obj_destroy() releases the object inmediately, this might lead to use-after-free of these objects that are being released. Make the existing rhltable per table to address this issue to deal with with the nft_rcv_nl_event() path too. Update nft_obj_lookup() to take the table as non-const, otherwise, compiler complains when passing the objname_ht to rhltable_lookup().
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 4d44175aa5bb5f68772b1eb0306554812294ca52 , < 4b549d32d34ee765527e63726bb1af984876e776 (git)
Affected: 4d44175aa5bb5f68772b1eb0306554812294ca52 , < 523c881661dde67efb44fce38c8eed50a72a57c1 (git)
Affected: 4d44175aa5bb5f68772b1eb0306554812294ca52 , < 1948e4f85b855618b5b9a27265f98d816f4cb7cb (git)
Affected: 4d44175aa5bb5f68772b1eb0306554812294ca52 , < 63ba12b664a2cd3220ed43e22c717715f4cc2ae8 (git)
Affected: 4d44175aa5bb5f68772b1eb0306554812294ca52 , < 7d4789b58761d9d48d9b5f5e7e0a510c3bbfb3af (git)
Affected: 4d44175aa5bb5f68772b1eb0306554812294ca52 , < f4f699790590bd0896c48a71e9232a65198f92f0 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.1
Unaffected: 0 , < 5.1 (semver)
Unaffected: 5.10.270 , ≤ 5.10.* (semver)
Unaffected: 6.1.188 , ≤ 6.1.* (semver)
Unaffected: 6.12.103 , ≤ 6.12.* (semver)
Unaffected: 6.18.44 , ≤ 6.18.* (semver)
Unaffected: 7.1.8 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/net/netfilter/nf_tables.h",
            "net/netfilter/nf_tables_api.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4b549d32d34ee765527e63726bb1af984876e776",
              "status": "affected",
              "version": "4d44175aa5bb5f68772b1eb0306554812294ca52",
              "versionType": "git"
            },
            {
              "lessThan": "523c881661dde67efb44fce38c8eed50a72a57c1",
              "status": "affected",
              "version": "4d44175aa5bb5f68772b1eb0306554812294ca52",
              "versionType": "git"
            },
            {
              "lessThan": "1948e4f85b855618b5b9a27265f98d816f4cb7cb",
              "status": "affected",
              "version": "4d44175aa5bb5f68772b1eb0306554812294ca52",
              "versionType": "git"
            },
            {
              "lessThan": "63ba12b664a2cd3220ed43e22c717715f4cc2ae8",
              "status": "affected",
              "version": "4d44175aa5bb5f68772b1eb0306554812294ca52",
              "versionType": "git"
            },
            {
              "lessThan": "7d4789b58761d9d48d9b5f5e7e0a510c3bbfb3af",
              "status": "affected",
              "version": "4d44175aa5bb5f68772b1eb0306554812294ca52",
              "versionType": "git"
            },
            {
              "lessThan": "f4f699790590bd0896c48a71e9232a65198f92f0",
              "status": "affected",
              "version": "4d44175aa5bb5f68772b1eb0306554812294ca52",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/net/netfilter/nf_tables.h",
            "net/netfilter/nf_tables_api.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.1"
            },
            {
              "lessThan": "5.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.270",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.103",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.44",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.8",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: make nft_object rhltable per table\n\nThe nft_object rhltable is global, this allows for accessing objects\nthat are being dismangled from lookup path by other existing netns.\nGiven the nft_obj_destroy() releases the object inmediately, this might\nlead to use-after-free of these objects that are being released.\nMake the existing rhltable per table to address this issue to deal with\nwith the nft_rcv_nl_event() path too.\n\nUpdate nft_obj_lookup() to take the table as non-const, otherwise,\ncompiler complains when passing the objname_ht to rhltable_lookup()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The UAF is triggered only through local NETLINK_NETFILTER nftables configuration syscalls (NFT_MSG_NEWOBJ/GETOBJ/DELOBJ and rule/objref setup) that call nft_obj_lookup(); per kernel CNA guidance, nf_tables/netlink is Local, not network-reachable packet processing.\nAC:L - The attacker controls both sides of the race by running concurrent Netlink sockets\u2014one closing to fire nft_rcv_nl_event()/__nft_release_table() object teardown and another issuing object lookups/commits\u2014and can retry until the global rhltable collision-chain walk hits freed memory.\nPR:L - All nf_tables Netlink handlers are gated by netlink_net_capable(skb, CAP_NET_ADMIN) in nfnetlink_rcv(); CAP_NET_ADMIN is obtainable by an unprivileged user inside a user+network namespace (unshare -Urn), not requiring init-namespace root.\nUI:N - No victim interaction is required; exploitation is fully attacker-driven through their own nftables Netlink operations and socket close events without another user mounting, opening files, or taking any action.\nS:U - Impact is kernel heap use-after-free and potential local privilege escalation within the same kernel security authority; this is standard in-kernel memory corruption, not a distinct VM-guest-to-host or sandbox-boundary escape.\nC:H - nft_obj_lookup() holds rcu_read_lock and walks the global rhltable collision chain, dereferencing struct nft_object fields (key.table, ops, genmask) that nft_obj_destroy() may have already kfree\u0027d, giving arbitrary kernel memory read potential from UAF.\nI:H - Immediate kfree after rhltable_remove without waiting for RCU readers enables classic slab UAF heap corruption that can be groomed into arbitrary kernel writes, control-flow hijacking, and local privilege escalation beyond a bounded or transient fault.\nA:H - Concurrent destruction via nft_rcv_nl_event() and active nft_obj_lookup() reliably provokes KASAN-class slab use-after-free kernel oops/panic during rhlist traversal; UAF is inherently crash-prone even when not fully weaponized for code execution."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T11:58:48.270Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/4b549d32d34ee765527e63726bb1af984876e776"
        },
        {
          "url": "https://git.kernel.org/stable/c/523c881661dde67efb44fce38c8eed50a72a57c1"
        },
        {
          "url": "https://git.kernel.org/stable/c/1948e4f85b855618b5b9a27265f98d816f4cb7cb"
        },
        {
          "url": "https://git.kernel.org/stable/c/63ba12b664a2cd3220ed43e22c717715f4cc2ae8"
        },
        {
          "url": "https://git.kernel.org/stable/c/7d4789b58761d9d48d9b5f5e7e0a510c3bbfb3af"
        },
        {
          "url": "https://git.kernel.org/stable/c/f4f699790590bd0896c48a71e9232a65198f92f0"
        }
      ],
      "title": "netfilter: nf_tables: make nft_object rhltable per table",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74565",
    "datePublished": "2026-08-15T12:28:07.015Z",
    "dateReserved": "2026-08-15T05:44:03.916Z",
    "dateUpdated": "2026-09-14T11:58:48.270Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-74565",
      "date": "2026-09-20",
      "epss": "0.00117",
      "percentile": "0.0189"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-16T01:46:51.000Z",
      "cve": "CVE-2026-74565",
      "id": "msrc_CVE-2026-74565",
      "initial_release_date": "2026-08-23T15:02:12.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "netfilter: nf_tables: make nft_object rhltable per table",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-74565.json",
      "version": "2"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "include/net/netfilter/nf_tables.h",
                  "net/netfilter/nf_tables_api.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "4b549d32d34ee765527e63726bb1af984876e776",
                    "status": "affected",
                    "version": "4d44175aa5bb5f68772b1eb0306554812294ca52",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "523c881661dde67efb44fce38c8eed50a72a57c1",
                    "status": "affected",
                    "version": "4d44175aa5bb5f68772b1eb0306554812294ca52",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "1948e4f85b855618b5b9a27265f98d816f4cb7cb",
                    "status": "affected",
                    "version": "4d44175aa5bb5f68772b1eb0306554812294ca52",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "63ba12b664a2cd3220ed43e22c717715f4cc2ae8",
                    "status": "affected",
                    "version": "4d44175aa5bb5f68772b1eb0306554812294ca52",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "7d4789b58761d9d48d9b5f5e7e0a510c3bbfb3af",
                    "status": "affected",
                    "version": "4d44175aa5bb5f68772b1eb0306554812294ca52",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f4f699790590bd0896c48a71e9232a65198f92f0",
                    "status": "affected",
                    "version": "4d44175aa5bb5f68772b1eb0306554812294ca52",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "include/net/netfilter/nf_tables.h",
                  "net/netfilter/nf_tables_api.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.1"
                  },
                  {
                    "lessThan": "5.1",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.270",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.188",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.103",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.44",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.8",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: make nft_object rhltable per table\n\nThe nft_object rhltable is global, this allows for accessing objects\nthat are being dismangled from lookup path by other existing netns.\nGiven the nft_obj_destroy() releases the object inmediately, this might\nlead to use-after-free of these objects that are being released.\nMake the existing rhltable per table to address this issue to deal with\nwith the nft_rcv_nl_event() path too.\n\nUpdate nft_obj_lookup() to take the table as non-const, otherwise,\ncompiler complains when passing the objname_ht to rhltable_lookup()."
          }
        ],
        "id": "CVE-2026-74565",
        "lastModified": "2026-09-14T13:18:45.557",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-15T13:18:02.013",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/1948e4f85b855618b5b9a27265f98d816f4cb7cb"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/4b549d32d34ee765527e63726bb1af984876e776"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/523c881661dde67efb44fce38c8eed50a72a57c1"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/63ba12b664a2cd3220ed43e22c717715f4cc2ae8"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/7d4789b58761d9d48d9b5f5e7e0a510c3bbfb3af"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/f4f699790590bd0896c48a71e9232a65198f92f0"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-17T14:56:05+00:00",
      "cve": "CVE-2026-74565",
      "id": "CVE-2026-74565",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_affected": "232",
      "product_status:known_not_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: netfilter: nf_tables: make nft_object rhltable per table",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74565.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-15T01:18:49Z",
      "cve": "CVE-2026-74565",
      "id": "CVE-2026-74565",
      "initial_release_date": "2026-08-15T23:50:04Z",
      "product_status:known_affected": "269",
      "product_status:known_not_affected": "93",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-74565",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-74565.json",
      "version": "6"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.