Linux CVE-2026-23399

The vulnerability exists in the nf_tables netfilter subsystem, specifically in the nft_dynset (dynamic set) module that handles dynamic rule evaluation and state tracking. The affected code path involves nft_dynset_new() which attempts to clone multiple stateful expressions (such as nft_counter) via nft_expr_clone() during element insertion into a dynamic set. When cloning the second stateful expression fails due to memory allocation failure under GFP_ATOMIC constraints (atomic context where blocking is forbidden), the code exits the error path without calling nft_expr_destroy() or similar cleanup on the already-cloned first expression. This results in a reference leak of percpu-allocated memory structures. The root cause is improper resource cleanup sequencing in error handling paths, classified as a resource management weakness (CWE-401: Missing Release of Memory after Effective Lifetime or similar). The percpu allocator is used to allocate per-CPU counter state, and each leaked allocation consumes 16 bytes per CPU, multiplied across systems with many CPUs.