Linux EUVD-2026-18190

The vulnerability exists in the Linux kernel netfilter subsystem's BPF hook handling code, specifically in the netlink hook dump functionality (nfnl_hook_dump_one). The root cause is a memory synchronization issue where hook memory is freed before RCU (Read-Copy-Update) readers have completed their critical sections. RCU is a kernel synchronization primitive that allows readers to access shared data without locking, but writers must defer memory reclamation until all concurrent readers finish. The netfilter hooks interface (nfnetlink_hooks) permits dumping active hooks via netlink, and when concurrent processes request hook information while another process modifies or removes hooks, the premature free creates a window where dangling pointers can be dereferenced. This is a classic race condition in kernel memory management, specifically a use-after-free (UaF) triggered through the netlink dumping path.