What is the CVSS score of CVE-2026-23385?

CVE-2026-23385 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-23385?

Yes, a patch is available for CVE-2026-23385. Update the affected software to the latest version immediately.

Linux CVE-2026-23385

EUVD-2026-15382 MEDIUM

2026-03-25 Linux

GHSA-g792-jhj8-228v

Linux Google Code Injection

5.5

CVSS 3.1 · NVD

View

Vulnerability Assessment

Impact

The actual risk from this vulnerability is moderate despite the lack of a CVSS score assignment. The vulnerability requires specific conditions to trigger: local or network namespace access to execute netfilter flush commands combined with triggered memory allocation failures through fault injection or resource exhaustion. The syzbot discovery methodology indicates this is not a trivial remote code execution vector but rather a kernel stability issue that could lead to denial of service through repeated flush operations under memory pressure. With no publicly reported active exploitation (KEV status not confirmed as exploited in the wild), no known public POC, and no CVSS vector data, this appears to be a hardening fix rather than an actively exploited critical vulnerability. However, the fact that Google Cloud infrastructure researchers identified this through syzbot fuzzing suggests it represents a real kernel stability concern in production environments, particularly relevant to containerized deployments where namespace operations are common. The patches being available across multiple kernel branches indicates upstream Linux maintainers assigned it meaningful priority for kernel stability and denial of service prevention.

Exploit ScenarioDerived

An attacker with local access or network namespace capabilities executes repeated netfilter flush operations (via nftables commands) targeting the set management code path while simultaneously triggering memory pressure or fault injection to cause GFP_KERNEL memory allocation failures. Each failed allocation triggers the WARN_ON condition in nft_map_deactivate, generating kernel warnings and potential kernel instability. In a containerized environment, an unprivileged container user with network namespace privileges could trigger this through repeated nftables flush commands combined with memory exhaustion, causing host kernel warnings or denial of service. No public POC has been disclosed, but the syzbot methodology that discovered this indicates it is reliably reproducible through coordinated memory allocation fault injection rather than requiring race conditions or complex exploitation techniques.

This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).

Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 25, 2026

A memory management vulnerability in the Linux kernel's netfilter nf_tables subsystem can be triggered through fault injection during set flush operations, causing a kernel warning splat when memory allocation fails under GFP_KERNEL conditions. This vulnerability affects Linux kernel versions across distributions and is exploitable by local attackers with network namespace capabilities, potentially leading to kernel warnings and denial of service through memory exhaustion attacks. While no CVSS score or active exploitation in the wild has been reported, the vulnerability was discovered through syzbot fuzzing with fault injection, indicating it requires specific conditions to trigger but represents a real kernel stability issue that has been patched.

RemediationAI

Update the Linux kernel to a version containing the fix from commit 9154945a6394029822bd08c24cef5a3f86d0424a or later versions. For users on stable kernel branches, apply patches from git.kernel.org/stable/c/9154945a6394029822bd08c24cef5a3f86d0424a, git.kernel.org/stable/c/b7f67282ca2be14b727dd698b50e10cf5d8c66f9, or git.kernel.org/stable/c/fb7fb4016300ac622c964069e286dc83166a5d52 as applicable to your kernel version. Contact your Linux distribution vendor (Red Hat, Canonical, Debian, etc.) for backported kernel packages that include these netfilter nf_tables fixes. Until patching is possible, mitigate by restricting access to netfilter management operations through iptables/nftables rule administration to trusted local users only, and avoid running untrusted network namespace operations that could trigger repeated flush commands under memory pressure. Monitor kernel logs for nft_map_deactivate warnings which would indicate exploitation attempts.

Affected VersionsENISA

Linux 3f1d886cc7c3525d4dbeee24bfa9bb3fe0d48ddc <fb7fb4016300ac622c964069e286dc83166a5d52

Linux patch: 6.19.7

Linux patch: 0

Linux 3f1d886cc7c3525d4dbeee24bfa9bb3fe0d48ddc <9154945a6394029822bd08c24cef5a3f86d0424a

Linux 3f1d886cc7c3525d4dbeee24bfa9bb3fe0d48ddc <b7f67282ca2be14b727dd698b50e10cf5d8c66f9

Linux 6.10

Linux patch: 6.18.17

Linux patch: 7.0-rc3

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The vulnerability resides in the netfilter subsystem's nf_tables API implementation, specifically in the set management code path during flush operations. The root cause involves improper handling of memory allocation failures when cloning sets during the preparation phase of flush commands, as evidenced by the warning at nft_map_deactivate+0x34e/0x3c0 in net/netfilter/nf_tables_api.c:845. The issue manifests when a GFP_KERNEL memory allocation fails, triggering a WARN_ON condition that should have been prevented by restricting set cloning only to necessary operations. The fix introduces a new NFT_ITER_UPDATE_CLONE iteration type to control when sets are cloned, and updates the rbtree and pipapo backends to respect this flag, ensuring cloning occurs only during the flush preparation phase rather than during deletion of bound anonymous sets. This is a kernel memory management issue within the Linux netfilter framework (CPE: cpe:2.3:a:linux:linux), affecting the core networking packet filtering infrastructure.

Know when the next one hits your stack

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

SUSE 3.3 LOW

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Red Hat 5.5 MEDIUM

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

CVSS changed

Apr 24, 2026 - 18:52 NVD

5.5 (MEDIUM)

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

CVE Published

Mar 25, 2026 - 10:28 nvd

N/A

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_tables: clone set on flush only

Syzbot with fault injection triggered a failing memory allocation with GFP_KERNEL which results in a WARN splat:

iter.err WARNING: net/netfilter/nf_tables_api.c:845 at nft_map_deactivate+0x34e/0x3c0 net/netfilter/nf_tables_api.c:845, CPU#0: syz.0.17/5992 Modules linked in: CPU: 0 UID: 0 PID: 5992 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 RIP: 0010:nft_map_deactivate+0x34e/0x3c0 net/netfilter/nf_tables_api.c:845 Code: 8b 05 86 5a 4e 09 48 3b 84 24 a0 00 00 00 75 62 48 8d 65 d8 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc e8 63 6d fa f7 90 <0f> 0b 90 43 +80 7c 35 00 00 0f 85 23 fe ff ff e9 26 fe ff ff 89 d9 RSP: 0018:ffffc900045af780 EFLAGS: 00010293 RAX: ffffffff89ca45bd RBX: 00000000fffffff4 RCX: ffff888028111e40 RDX: 0000000000000000 RSI: 00000000fffffff4 RDI: 0000000000000000 RBP: ffffc900045af870 R08: 0000000000400dc0 R09: 00000000ffffffff R10: dffffc0000000000 R11: fffffbfff1d141db R12: ffffc900045af7e0 R13: 1ffff920008b5f24 R14: dffffc0000000000 R15: ffffc900045af920 FS: 000055557a6a5500(0000) GS:ffff888125496000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fb5ea271fc0 CR3: 000000003269e000 CR4: 00000000003526f0 Call Trace: <TASK> __nft_release_table+0xceb/0x11f0 net/netfilter/nf_tables_api.c:12115 nft_rcv_nl_event+0xc25/0xdb0 net/netfilter/nf_tables_api.c:12187 notifier_call_chain+0x19d/0x3a0 kernel/notifier.c:85 blocking_notifier_call_chain+0x6a/0x90 kernel/notifier.c:380 netlink_release+0x123b/0x1ad0 net/netlink/af_netlink.c:761 __sock_release net/socket.c:662 [inline] sock_close+0xc3/0x240 net/socket.c:1455

Restrict set clone to the flush set command in the preparation phase. Add NFT_ITER_UPDATE_CLONE and use it for this purpose, update the rbtree and pipapo backends to only clone the set when this iteration type is used.

As for the existing NFT_ITER_UPDATE type, update the pipapo backend to use the existing set clone if available, otherwise use the existing set representation. After this update, there is no need to clone a set that is being deleted, this includes bound anonymous set.

An alternative approach to NFT_ITER_UPDATE_CLONE is to add a .clone interface and call it from the flush set path.

Threat Intelligence Overview

EPSS Score

0.0%

Top 96% exploitable

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS Vendor

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity MEDIUM

CISA KEV No

Public POC No

EPSS 0.0%

Patch available Yes

Active threat No

Deciding rule

MEDIUM severity (CVSS 4.0-6.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Defer

Exploitation· derived

None

System Exposure· derived

Small

Automatable· derived

Human Impact· derived

Medium

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +28

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Code Injection CRITICAL

Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.

Related Vulnerabilities in netfilter nf_tables RCU and Clone Issues

View all 2

CVE-2026-23392 HIGH

7.8

Same technique Code Injection

View all

CVE-2023-3519 CRITICAL POC

9.8

CVE-2021-22205 CRITICAL POC

10.0

CVE-2024-23692 CRITICAL POC

9.8

CVE-2012-0158 HIGH POC

8.8

CVE-2021-44529 CRITICAL POC

9.8

CVE-2014-6287 CRITICAL POC

9.8

CVE-2017-7494 CRITICAL POC

9.8

CVE-2025-24893 CRITICAL POC

9.8

Vendor StatusVendor

Debian

linux

Release	Status	Fixed Version	Urgency
bullseye	not-affected	-	-
bullseye (security)	fixed	5.10.251-1	-
bookworm	not-affected	-	-
bookworm (security)	fixed	6.1.164-1	-
trixie	vulnerable	6.12.73-1	-
trixie (security)	vulnerable	6.12.74-2	-
forky, sid	fixed	6.19.8-1	-
(unstable)	fixed	6.19.8-1	-

SUSE

Severity: Low

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Fixed
SUSE Linux Enterprise Desktop 15 SP7	Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7	Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7	Fixed

References

Advisories & patches

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-23385 ADVISORY https://ubuntu.com/security/notices/USN-9022-1 ADVISORY https://ubuntu.com/security/notices/USN-9023-1 ADVISORY https://vuldb.com/vuln/353021 REF https://git.kernel.org/stable/c/454306ceb94dc47a52443181082c91204c007a74 REF https://git.kernel.org/stable/c/9154945a6394029822bd08c24cef5a3f86d0424a REF https://git.kernel.org/stable/c/9e63e1c2b171d30f5351b89b0a5d3926902f9ca6 REF https://git.kernel.org/stable/c/b7f67282ca2be14b727dd698b50e10cf5d8c66f9 REF https://git.kernel.org/stable/c/e38f054f0af98224003e600545726fbd96379cfb REF https://git.kernel.org/stable/c/fb7fb4016300ac622c964069e286dc83166a5d52

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back