EUVD-2026-108855
GHSA-ffrw-gp84-hx8m
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain local account with ipset/CAP_NET_ADMIN capability
-
DeliveryInvoke affected ipset hash-table operation
-
ExploitTrigger improper RCU-locked access path
-
ExecutionCorrupt kernel memory / inconsistent reference state
-
ImpactEscalate privileges or crash kernel
Vulnerability Assessment
| Exploitation Conditions | Exploitation requires local access and the capability to operate on netfilter ipset objects - in practice CAP_NET_ADMIN within a namespace that can manage ipsets - against a kernel built with netfilter ipset support (CONFIG_IP_SET). This is not remotely reachable (AV:L) and is not available to a fully unprivileged user lacking ipset management rights, which materially limits the attacker population. The specific code paths are the uref counter increment and mtype_gc garbage-collection routine; however, the exact input or sequence that triggers unsafe behavior is not described in the available sources, so whether a standard ipset manipulation suffices or a specific race window is required cannot be confirmed from the data provided. |
| Impact | Signals are consistent in pointing to a real-but-not-urgent local kernel issue. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 7.8) indicates local attack vector requiring some privileges (PR:L) with high confidentiality, integrity and availability impact - the classic profile of a kernel memory-safety/locking defect rather than a remotely reachable flaw. EPSS is low at 0.21% (11th percentile), and the vulnerability is NOT listed in CISA KEV, so there is no evidence of active exploitation; exploitation status is 'no public exploit identified at time of analysis' (references are git.kernel.org commits and NVD/VulDB advisories, not exploit code). The vuln.today priority of 'this_week' and vendor patch availability align with a patch-on-schedule posture, not an emergency. One caveat: the description ('mark the rcu locked areas properly' in netfilter ipset) does not describe a concrete trigger or demonstrate memory corruption, so the mapping to full C:H/I:H/A:H is the generic kernel-locking assumption and is not independently verified from the supplied text. CWE is N/A in the input, so the precise weakness class is unconfirmed. |
| Exploit ScenarioDerived | A local user with the privileges needed to manipulate netfilter ipset structures (typically CAP_NET_ADMIN, in the initial or a privileged namespace) exercises the affected ipset code path whose RCU/spinlock protection was incorrect, aiming to provoke a use-after-free or inconsistent state in the referenced hash table and escalate privileges or crash the host. No public exploit code is identified at time of analysis, and the exact trigger is not described in the available sources. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 24, 2026
Improper RCU locking discipline in the Linux kernel's netfilter ipset subsystem allows a local attacker who can manage ipset objects to reach the referred hash tables outside a protected RCU read-side critical section, with the assessed impact being high confidentiality, integrity and availability loss on the affected host. Every kernel branch released before the fixed versions is affected, but reachability is limited: the attacker must already hold ipset management capability (in practice CAP_NET_ADMIN, assessed PR:H) on a kernel built with netfilter ipset support, so this is not remotely reachable and not available to a fully unprivileged user. EPSS is low at 0.21% (11th percentile), there is no KEV listing, and no public exploit has been identified at time of analysis. The exact input or sequence that triggers the unsafe behaviour is not described in the available sources.
RemediationAI
Vendor-released patches exist for every supported branch: upgrade to Linux 5.10.271, 5.15.222, 6.1.189, 6.6.158, 6.12.111, 6.18.53 or 7.2 (or apply the corresponding stable commit listed in the references, e.g. https://git.kernel.org/stable/c/67bd3d2350d17c2f4fb158c3f917c10b15ecbc94); distribution kernels will carry the fix in their next kernel update, so track the vendor erratum rather than the upstream tag. Because the flaw is only reachable by a caller that can manage ipset objects, the effective compensating control is to restrict who holds CAP_NET_ADMIN and ipset management rights - keep container and namespace users unprivileged so they cannot create or manipulate ipsets, since granting that capability re-exposes the host kernel. Where ipsets are not in use, preventing the ip_set modules from loading (module blacklist or CONFIG_IP_SET disabled at build time) removes the attack surface entirely, at the cost of breaking any firewall rules that depend on ipset matches. Note that no mitigation short of the locking fix is complete, since the underlying defect is in kernel synchronization code rather than in a configurable policy.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
ipset is the netfilter set extension that stores large address/port sets (hash:ip, hash:net, list:set and similar types) in kernel hash tables so that iptables/nftables rules can match against them efficiently. Those hash tables are reference counted through a uref counter and are looked up locklessly from packet-processing paths, which is why RCU is used: readers stay inside rcu_read_lock()/rcu_read_unlock() critical sections while writers defer freeing until a grace period elapses. The upstream fix, titled 'netfilter: ipset: mark the rcu locked areas properly', corrects the placement of those critical sections: the uref counter bump does not need to hold the RCU lock because the referred hash table cannot disappear while referenced, while the mtype_gc garbage-collection routine does require the RCU lock rather than the spinlock it was using. The underlying weakness class is incorrect synchronization / misuse of RCU read-side protection in kernel code, which can produce use-after-free or inconsistent access to the referred table; no CWE identifier is assigned in the supplied data. The affected objects and code paths are the uref increment and mtype_gc, but the precise packet-level or ipset-command sequence that turns the mis-marked locking into memory corruption is not described in the available sources, so it cannot be confirmed whether ordinary ipset manipulation suffices or a specific race window is needed. Exploitation requires a local context with the ability to operate on ipsets - in practice CAP_NET_ADMIN in a namespace that can manage ipsets - against a kernel compiled with CONFIG_IP_SET; the assessed vector is AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Managing netfilter ipset requires CAP_NET_ADMIN, so PR:H and AV:L; the trigger is not described, so impacts mirror the generic kernel memory-corruption assumption (C/I/A:H).
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
4DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
netfilter: ipset: mark the rcu locked areas properly
When we bump the uref counter, there's no need to keep the rcu lock because the referred hash table can't disappear. Also, from the same reason in mtype_gc we need the rcu lock and not a spinlock.
Executive ViewAI
A high-severity flaw in the Linux kernel's netfilter ipset subsystem could allow a privileged local user to compromise the confidentiality, integrity, and availability of affected hosts. Because exploitation requires existing administrative network privileges, risk is concentrated in environments with broad privileged access-multi-tenant hosts, container platforms, and systems where elevated users are not tightly controlled. While no active exploitation has been observed, leadership should prioritize patching affected kernel fleets to close a known gap.
Vendor-released patch: apply fixed kernel versions per vendor advisory; until then reduce the population of users with CAP_NET_ADMIN and disable netfilter ipset support where not operationally required.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB