What is the CVSS score of CVE-2026-23392?

CVE-2026-23392 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-23392?

Yes, a patch is available for CVE-2026-23392. Update the affected software to the latest version immediately.

Linux CVE-2026-23392

EUVD-2026-15393 HIGH

Use After Free (CWE-416)

2026-03-25 Linux

GHSA-f5vj-m443-mgw6

Information Disclosure Linux Use After Free Memory Corruption

7.8

CVSS 3.1 · Vendor: Linux

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Trigger flowtable error path
Exploit

Skip RCU synchronization
Execution

Access dangling flowtable reference
Impact

Corrupt kernel memory or escalate privileges

Vulnerability Assessment

Weakness	CWE CWE-416 ASVS 5.0 V15 - Secure Coding and Architecture Memory lifecycle management MITRE ATT&CK 2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Requires local authenticated user access to Linux kernel netfilter nf_tables subsystem. Exploitation occurs when hardware offload setup fails or maximum hook limits are reached during flowtable configuration, exposing a use-after-free condition in packet processing path.
Impact	While formal CVSS scoring and EPSS probability data are not provided, the technical signals indicate moderate real-world risk. The vulnerability is a use-after-free condition in kernel memory management, which typically carries high severity due to potential for privilege escalation or denial of service; however, exploitation requires specific preconditions: the error path activation is rare (documented as requiring maximum hook exhaustion or hardware offload failure), kernel-level exploitation constraints apply, and the race condition window is narrow. The vulnerability has not appeared in KEV (Known Exploited Vulnerabilities) catalogs, suggesting no active in-the-wild exploitation as of now. The presence of six distinct stable kernel commits across multiple versions indicates vendor acknowledgment and patch availability, reducing practical risk for patched deployments. For unpatched systems actively using nf_tables flowtables with hardware offload or under high hook pressure, the risk transitions from theoretical to elevated due to the deterministic triggering of error paths under resource exhaustion.
Exploit ScenarioDerived	An attacker with local network access to a system running vulnerable nf_tables flowtables could trigger the vulnerability by exhausting available hook slots or forcing hardware offload configuration failures, causing an error path activation. Simultaneously, the attacker could invoke nfnetlink_hook control plane operations (via netlink sockets) to dump active hooks, which would trigger access to the freed flowtable memory during the race window before RCU grace period expiration. This scenario would manifest as a kernel crash (denial of service) or potential information disclosure if the freed memory region contains sensitive data. While proof-of-concept code is not documented in available references, the KASAN discovery confirms the vulnerability is reliably triggerable through documented error conditions and netlink operation sequencing.

Act Now Prioritize within 24-48h. Why: Active threat signals + CRITICAL/HIGH severity.

Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 25, 2026

A use-after-free vulnerability exists in the Linux kernel's netfilter nf_tables flowtable implementation during error handling in the hook registration path. When hook registration fails (due to reaching maximum hook limits or hardware offload setup failures), the flowtable is not properly synchronized with RCU grace periods before being released, allowing concurrent packet processing or control plane operations (nfnetlink_hook) to access freed memory. This vulnerability affects all Linux kernel versions with the vulnerable nf_tables code and was discovered via KASAN reports during hook dumping operations; while not currently listed in known exploited vulnerabilities (KEV) databases, the use-after-free nature presents a real risk for denial of service or information disclosure in environments utilizing netfilter flowtables.

RemediationAI

Apply the upstream kernel patch immediately by upgrading to a patched kernel version corresponding to your distribution and branch. The fix involves adding synchronize_rcu() calls in the nf_tables flowtable error handling path, as implemented in the referenced kernel commits. Verify your kernel version contains one of the stable commit hashes (d2632de96ccb066e0131ad1494241b9c281c60b8 or equivalents across branches) by checking kernel release notes or using git log. Until patching is feasible, administratively disable hardware offload for netfilter flowtables via sysctl or module parameters to eliminate the primary error trigger, and monitor system logs for KASAN warnings indicating use-after-free. For production environments, prioritize patching as the sole reliable mitigation, since workarounds are limited and the vulnerability is only triggered under specific operational conditions (resource exhaustion or hardware offload configuration).

Affected VersionsENISA

Linux patch: 6.12.78

Linux 3b49e2e94e6ebb8b23d0955d9e898254455734f8 <d2632de96ccb066e0131ad1494241b9c281c60b8

Linux 3b49e2e94e6ebb8b23d0955d9e898254455734f8 <7e3955b282eae20d61c75e499c75eade51c20060

Linux patch: 6.6.130

Linux 3b49e2e94e6ebb8b23d0955d9e898254455734f8 <d73f4b53aaaea4c95f245e491aa5eeb8a21874ce

Linux 4.16

Linux 3b49e2e94e6ebb8b23d0955d9e898254455734f8 <e78a2dcc7cfb87b64a631441ca7681492b347ef6

Linux patch: 0

Linux patch: 6.1.167

Linux 3b49e2e94e6ebb8b23d0955d9e898254455734f8 <c8092edb9a11f20f95ccceeb9422b7dd0df337bd

Linux 3b49e2e94e6ebb8b23d0955d9e898254455734f8 <adee3436ccd29f1e514c028899e400cbc6d84065

Linux patch: 7.0-rc5

Linux patch: 6.18.20

Linux patch: 6.19.10

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The vulnerability resides in the Linux kernel's netfilter subsystem (CPE: cpe:2.3:a:linux:linux), specifically within the nf_tables flowtable hook registration error handling path. Flowtables are a kernel-based connection tracking optimization mechanism used for high-performance packet forwarding. The root cause is a synchronization issue where the kernel fails to call synchronize_rcu() after unregistering hooks during error conditions, violating RCU (Read-Copy-Update) semantics that protect against use-after-free in concurrent contexts. The error path is triggered when either the maximum number of hooks is exceeded or hardware offload configuration fails (EEXIST errors from duplicate device hooks). The vulnerability was uncovered through KASAN (Kernel Address Sanitizer) instrumentation detecting use-after-free access patterns when the nfnetlink_hook control plane dumped active hooks, indicating that packet processing code could concurrently access the flowtable structure after it was freed.

Know when the next one hits your stack

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Linux) PRIMARY 7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SUSE 6.4 MEDIUM

AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Red Hat 7.0 MEDIUM

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

CVE Published

Mar 25, 2026 - 10:33 nvd

HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_tables: release flowtable after rcu grace period on error

Call synchronize_rcu() after unregistering the hooks from error path, since a hook that already refers to this flowtable can be already registered, exposing this flowtable to packet path and nfnetlink_hook control plane.

This error path is rare, it should only happen by reaching the maximum number hooks or by failing to set up to hardware offload, just call synchronize_rcu().

There is a check for already used device hooks by different flowtable that could result in EEXIST at this late stage. The hook parser can be updated to perform this check earlier to this error path really becomes rarely exercised.

Uncovered by KASAN reported as use-after-free from nfnetlink_hook path when dumping hooks.

Threat Intelligence Overview

EPSS Score

0.0%

Top 93% exploitable

Threat Intel

1 source

Data Quality

7 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS CISA Vendor

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.0%

Patch available Yes

Active threat Yes

Deciding rule

Active threat signals + CRITICAL/HIGH severity

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Defer

Exploitation· derived

None

System Exposure· derived

Small

Automatable· derived

Human Impact· derived

Medium

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +39

PoC: 0

Weaponized: 0

Threat intel: +10

Gov advisory: 0

Attack Technique

Use After Free HIGH

Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.

Memory Corruption HIGH

Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Related Vulnerabilities in netfilter nf_tables RCU and Clone Issues

View all 2

CVE-2026-23385 MEDIUM

5.5

Same weakness CWE-416 – Use After Free

View all

CVE-2019-0708 CRITICAL POC

9.8

CVE-2015-5119 CRITICAL POC

9.8

CVE-2014-0322 HIGH POC

8.8

CVE-2012-4792 HIGH POC

8.8

CVE-2009-4324 HIGH POC

7.8

CVE-2015-0313 CRITICAL POC

9.8

CVE-2015-5122 CRITICAL POC

9.8

CVE-2013-2551 HIGH POC

8.8

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2025-68613 HIGH POC

8.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

Vendor StatusVendor

Debian

linux

Release	Status	Fixed Version	Urgency
bullseye	vulnerable	5.10.223-1	-
bullseye (security)	vulnerable	5.10.251-1	-
bookworm	vulnerable	6.1.159-1	-
bookworm (security)	vulnerable	6.1.164-1	-
trixie	vulnerable	6.12.73-1	-
trixie (security)	vulnerable	6.12.74-2	-
forky, sid	vulnerable	6.19.8-1	-
(unstable)	fixed	(unfixed)	-

SUSE

Severity: Medium

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Fixed
SUSE Linux Enterprise Desktop 15 SP7	Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7	Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7	Fixed

Threat IntelligenceMISP

CISA Advisories

ICSA-26-209-04 ICSA-26-295-11 ICSA-26-295-16

Sources: CISA (public domain)

References

Advisories & patches

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back