EUVD-2026-59407
GHSA-3847-fgf2-64xp
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Race condition requires precise CPU migration timing, elevating AC to H; local access and low-privilege user required, so AV:L and PR:L are confirmed.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them
Update nft_dup and nft_fwd to use the nf_dev_xmit_recursion() helpers. This patch also disables BH when transmitting the skb to address a possible migration to different CPU leading to imbalanced decrementation of the recursion counters.
This is modeled after Florian Westphal's dev_xmit_recursion*() API available since commit 97cdcf37b57e ("net: place xmit recursion in softnet data") according to its current state in the tree.
AnalysisAI
Netfilter's nf_dup_netdev component in the Linux kernel exposes a race condition in nft_dup and nft_fwd expressions where the absence of Bottom Half disabling during skb transmission permits CPU migration, causing imbalanced decrementation of xmit recursion counters. A locally authenticated low-privilege user who can influence netfilter packet processing paths may exploit this counter imbalance to escalate privileges or destabilize the kernel. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires local authenticated access with sufficient privilege to create network namespaces and configure nftables rules (typically CAP_NET_ADMIN within a user namespace, which unprivileged users can obtain on many default Linux configurations). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/C:H/I:H/A:H) reflects worst-case post-exploitation impact and should be treated with nuance. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A local attacker with a standard unprivileged account on a Linux system running an affected kernel version crafts a network namespace and installs nftables rules using nft_dup or nft_fwd expressions that trigger packet duplication through nf_dup_netdev. By repeatedly transmitting packets across CPU boundaries during periods of high scheduler activity, the attacker races to produce a state where the xmit recursion counter on one CPU is permanently incremented without a matching decrement. … |
| Remediation | The primary fix is to apply the upstream kernel stable patches at commits edf234f71fb327792196f813048ab8f5bd3bb712 (https://git.kernel.org/stable/c/edf234f71fb327792196f813048ab8f5bd3bb712) and 2354e975932dabb06fad239f07a3b68fd1809737 (https://git.kernel.org/stable/c/2354e975932dabb06fad239f07a3b68fd1809737). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, query your systems management and vulnerability scanning tools to identify and inventory all Linux deployments running vulnerable kernel versions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today