CVE-2026-23278

CVE.org · Published

Record status: Published
Identifier year (not publication year): 2026
Source publication: Mar 20, 2026
Source updated: Oct 19, 2026
Imported by cveboard: Oct 24, 2026
Source snapshot: cve_2026-10-24_midnight_baseline · Oct 24, 2026

CNA source text (English)

netfilter: nf_tables: always walk all pending catchall elements

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: always walk all pending catchall elements During transaction processing we might have more than one catchall element: 1 live catchall element and 1 pending element that is coming as part of the new batch. If the map holding the catchall elements is also going away, its required to toggle all catchall elements and not just the first viable candidate. Otherwise, we get: WARNING: ./include/net/netfilter/nf_tables.h:1281 at nft_data_release+0xb7/0xe0 [nf_tables], CPU#2: nft/1404 RIP: 0010:nft_data_release+0xb7/0xe0 [nf_tables] [..] __nft_set_elem_destroy+0x106/0x380 [nf_tables] nf_tables_abort_release+0x348/0x8d0 [nf_tables] nf_tables_abort+0xcf2/0x3ac0 [nf_tables] nfnetlink_rcv_batch+0x9c9/0x20e0 [..]

Scoped product and version facts

Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.

Exploitation unknown; this catalogue does not assess exploitation.

Linux

Vendor: Linux
Product: Linux
Platforms: Unknown
Default status: unaffected

Linux · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
d60be2da67d172aecf866302c91ea11533eca4d9	`affected`	git	c4d4e86fda707d89eaba80e343321737375f8582	Unavailable	None listed
628bd3e49cba1c066228e23d71a852c23e26da73	`affected`	git	4830fb44d12f586f3f544609e086933649a9175a	Unavailable	None listed
628bd3e49cba1c066228e23d71a852c23e26da73	`affected`	git	eb0948fa13298212c5f8b30ee48efdae4389ab09	Unavailable	None listed
628bd3e49cba1c066228e23d71a852c23e26da73	`affected`	git	de47a88c6b807910f05703fb6605f7efdaa11417	Unavailable	None listed
628bd3e49cba1c066228e23d71a852c23e26da73	`affected`	git	77c26b5056d693ffe5e9f040e946251cdb55ae55	Unavailable	None listed
628bd3e49cba1c066228e23d71a852c23e26da73	`affected`	git	7cb9a23d7ae40a702577d3d8bacb7026f04ac2a9	Unavailable	None listed
bc9f791d2593f17e39f87c6e2b3a36549a3705b1	`affected`	git	Unavailable	Unavailable	None listed
3c7ec098e3b588434a8b07ea9b5b36f04cef1f50	`affected`	git	Unavailable	Unavailable	None listed
a136b7942ad2a50de708f76ea299ccb45ac7a7f9	`affected`	git	Unavailable	Unavailable	None listed
25aa2ad37c2162be1c0bc4fe6397f7e4c13f00f8	`affected`	git	Unavailable	Unavailable	None listed
dc7cdf8cbcbf8b13de1df93f356ec04cdeef5c41	`affected`	git	Unavailable	Unavailable	None listed
6.1.36	`affected`	semver	6.1.177	Unavailable	None listed
4.19.316	`affected`	semver	4.20	Unavailable	None listed
5.4.262	`affected`	semver	5.5	Unavailable	None listed
5.10.188	`affected`	semver	5.11	Unavailable	None listed
5.15.121	`affected`	semver	5.16	Unavailable	None listed
6.3.10	`affected`	semver	6.4	Unavailable	None listed

Linux

Vendor: Linux
Product: Linux
Platforms: Unknown
Default status: affected

Linux · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
6.4	`affected`	Unavailable	Unavailable	Unavailable	None listed
0	`unaffected`	semver	6.4	Unavailable	None listed
6.1.177	`unaffected`	semver	Unavailable	6.1.*	None listed
6.6.144	`unaffected`	semver	Unavailable	6.6.*	None listed
6.12.78	`unaffected`	semver	Unavailable	6.12.*	None listed
6.18.19	`unaffected`	semver	Unavailable	6.18.*	None listed
6.19.9	`unaffected`	semver	Unavailable	6.19.*	None listed
7.0	`unaffected`	original_commit_for_fix	Unavailable	*	None listed