EUVD-2026-66576
GHSA-4hwc-233g-5mv3
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Reachable via network traffic but only on offload-configured systems and only by winning a race (AC:H); memory corruption yields reliable DoS and integrity impact, with confidentiality lower and speculative.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
netfilter: flowtable: publish GC-visible tuple last
nf_flow_table_iterate() only treats original-direction tuple nodes as owning entries. Publishing the original node first lets GC observe and free a flow while flow_offload_add() is still inserting the reply node. Publish the reply node first and the original node last so GC never sees a partially installed flow.
KASAN can trigger slab-use-after-free read and write reports in the flowtable/rhashtable path (rht_deferred_worker, jhash, flow_offload_del, flow_offload_lookup, etc.).
AnalysisAI
Use-after-free in the Linux kernel netfilter flowtable (nf_flow_table_offload) arises from an ordering bug in how connection-tracking tuple nodes are published to the rhashtable. Because nf_flow_table_iterate() treats only the original-direction node as the owning entry, publishing it before the reply node lets the garbage collector observe and free a flow while flow_offload_add() is still inserting the reply node, producing slab-use-after-free reads and writes reachable through rht_deferred_worker, jhash, flow_offload_del and flow_offload_lookup. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the netfilter flowtable/flow-offload feature to be explicitly configured and active (an nftables flowtable with 'flags offload' forwarding established connections) - it is not reachable on default kernels without flow offload. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, 9.8) is the Linux CNA's uniform kernel scoring and almost certainly overstates real-world exploitability: the defect is a narrow race window that requires the flowtable/flow-offload feature to be configured and actively processing traffic, so AC:L is questionable and a race-condition AC:H is more defensible. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | On a router or firewall with nftables flow offload enabled, an attacker (or high-traffic conditions) drives many short-lived connections through the box so flows are rapidly added and expired, racing flow_offload_add() against the GC worker to hit the free-while-installing window. A successful race corrupts freed slab memory, most reliably crashing the kernel (DoS) and potentially enabling controlled memory corruption; no public exploit is identified at time of analysis. |
| Remediation | Upgrade to a fixed stable kernel for your series - Vendor-released patch: 5.10.266, 5.15.217, 6.1.184, 6.6.153, 6.12.105, or 6.18.46 (and 7.1.10/7.2 where applicable) - or apply the upstream fix commits published at git.kernel.org/stable/c/0a00254585827f1695aa2700114af622ea754cfa, .../be345dcbddb4643a54252b954af974b16eda8f91, .../211ee5d998d92a7d548811939c65942d06c146e4, .../d37917e7bebe078f3c17e47fd6fc1c9f6e8497b2, .../972fdf7c4f5c282a239c88fea614b056c33dc025, .../d9d3050a70efe217e73a0751e55fdae6a7092620, .../d16b71231e65cb05daea2b45701fcf09cef041e7, and .../2014ac62df9d45bb9a004a043e85df7be09ed780, which reorder publication so the reply node is inserted before the original node. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Linux systems with netfilter flow offload enabled by checking kernel configuration and /proc/net/nf_conntrack settings, and document each system's criticality level. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today