Bug 2449571 (CVE-2026-23272)

Summary: CVE-2026-23272 kernel: netfilter: nf_tables: unconditionally bump set->nelems before insertion
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the Linux kernel's netfilter nf_tables component. A race condition occurs when elements are inserted into a full set, causing an element to be removed without proper synchronization with Read-Copy-Update (RCU) readers. This can allow a local attacker to trigger a use-after-free vulnerability, potentially leading to a denial of service or other unspecified impacts.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-03-20 09:03:19 UTC 
In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_tables: unconditionally bump set->nelems before insertion

In case that the set is full, a new element gets published then removed
without waiting for the RCU grace period, while RCU reader can be
walking over it already.

To address this issue, add the element transaction even if set is full,
but toggle the set_full flag to report -ENFILE so the abort path safely
unwinds the set to its previous state.

As for element updates, decrement set->nelems to restore it.

A simpler fix is to call synchronize_rcu() in the error path.
However, with a large batch adding elements to already maxed-out set,
this could cause noticeable slowdown of such batches.
Comment 1 Alexander B 2026-03-20 12:16:49 UTC 
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026032034-CVE-2026-23272-8ad1@gregkh/T