CVE-2026-23272
Published: 20 March 2026
Summary
CVE-2026-23272 is a high-severity an unspecified weakness vulnerability in Linux Linux Kernel. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 4.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and RA-5 (Vulnerability Monitoring and Scanning).
Deeper analysis
CVE-2026-23272 is a vulnerability in the Linux kernel's netfilter nf_tables subsystem, where set element insertion unconditionally increments the set->nelems counter before checking if the set is full. When the set reaches its maximum capacity, the new element is published and then immediately removed without waiting for an RCU grace period, potentially allowing an RCU reader to access the removed element. This issue was published on 2026-03-20 and carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
A local attacker with low privileges can exploit this vulnerability due to its low attack complexity and lack of user interaction requirements. Successful exploitation could result in high impacts on confidentiality, integrity, and availability, likely through a use-after-free or related memory corruption in the nf_tables set handling.
The provided patch references from kernel.org stable branches detail the mitigation, which involves adding the element transaction even when the set is full and toggling a set_full flag to return -ENFILE, allowing the abort path to safely unwind the set to its prior state. For element updates, set->nelems is decremented to restore the count. An alternative simpler fix of calling synchronize_rcu() in the error path was considered but rejected due to potential slowdowns with large batches on maxed-out sets.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-13607
Vulnerability details
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: unconditionally bump set->nelems before insertion In case that the set is full, a new element gets published then removed without waiting for the RCU grace period, while RCU…
more
reader can be walking over it already. To address this issue, add the element transaction even if set is full, but toggle the set_full flag to report -ENFILE so the abort path safely unwinds the set to its previous state. As for element updates, decrement set->nelems to restore it. A simpler fix is to call synchronize_rcu() in the error path. However, with a large batch adding elements to already maxed-out set, this could cause noticeable slowdown of such batches.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local kernel use-after-free in nf_tables directly enables privilege escalation via crafted set operations.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires timely identification, reporting, and correction of software flaws like the RCU grace period issue in nf_tables set insertion via kernel patching.
Facilitates ongoing vulnerability scanning to identify and prioritize remediation of kernel vulnerabilities such as CVE-2026-23272.
Implements memory protection mechanisms that can mitigate exploitation of use-after-free conditions arising from improper RCU handling in netfilter sets.