Linux Kernel EUVD-2026-35414

Requires local code execution on the target host with the ability to issue netlink NFNL_SUBSYS_NFTABLES messages - in practice, either an unprivileged local shell on a kernel built with CONFIG_NF_TABLES where unprivileged user namespaces are enabled (granting CAP_NET_ADMIN inside the namespace), or any process already holding CAP_NET_ADMIN in the init namespace. Triggering the race specifically requires concurrent operations: one task performing nft_netdev_unregister_hooks or __nft_unregister_flowtable_net_hooks (chain/flowtable teardown for a netdev family) while another task issues a netlink dump that walks the same hook list. Limiting factors per CVSS AV:L/PR:L: no remote network reachability, no user interaction, but the attacker must already have a local account or code execution and the host must expose nf_tables to that account; hardened deployments that disable user namespaces or restrict netlink via seccomp/LSM are not exploitable by unprivileged users.

Signals are mixed and lean toward 'patch on normal cycle, not emergency.' CVSS 7.8 with AV:L/AC:L/PR:L/UI:N/C:H/I:H/A:H reflects a credible local privilege-escalation primitive once weaponised, consistent with prior nf_tables UAF-style races that have produced kernel exploits. However, EPSS is only 0.02% (4th percentile), the CVE is not in CISA KEV, and no public exploit identified at time of analysis. The provided 'Information Disclosure' tag conflicts with the CVSS impact triad (C:H/I:H/A:H) - the tag appears to understate impact and should be disregarded in favour of the CVSS vector and the underlying RCU-race root cause, which historically yields privilege escalation, not just info leak. Note also that the description does not explicitly call out an exploitable race window or describe attacker steps, so high impact is inferred from the bug class rather than confirmed by a working PoC.

A local user on a multi-tenant Linux host (e.g., a shared CI runner, container host with unprivileged user namespaces enabled, or compromised low-privilege service account) opens two netlink sockets to the nf_tables subsystem: one issues rapid create/delete cycles of a netdev chain or flowtable while the other concurrently dumps hooks. The unsynchronised list_del during teardown races against the RCU-protected reader, yielding a use-after-free or torn list traversal that an attacker can groom into a kernel write/read primitive for privilege escalation. No public PoC identified at time of analysis, so weaponisation effort is non-trivial but consistent with prior nf_tables UAF exploits.