Skip to main content

Linux Kernel EUVDEUVD-2026-38868

| CVE-2026-53000 HIGH
Release of Invalid Pointer or Reference (CWE-763)
2026-06-24 Linux GHSA-6794-4vqv-w8qg
Linux Information Disclosure
7.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.0 HIGH

Local-only UAF (AV:L) needing CAP_NET_ADMIN (PR:L) and a timing race against the hook dump (AC:H); kernel memory corruption yields high C/I/A.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
7.0 HIGH
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jun 28, 2026 - 08:46 vuln.today
CVSS changed
Jun 28, 2026 - 08:22 NVD
7.8 (HIGH)
Patch available
Jun 24, 2026 - 18:02 EUVD
CVE Published
Jun 24, 2026 - 16:29 cve.org
HIGH 7.8
CVE Published
Jun 24, 2026 - 16:29 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nat: use kfree_rcu to release ops

Florian Westphal says:

"Historically this is not an issue, even for normal base hooks: the data path doesn't use the original nf_hook_ops that are used to register the callbacks.

However, in v5.14 I added the ability to dump the active netfilter hooks from userspace.

This code will peek back into the nf_hook_ops that are available at the tail of the pointer-array blob used by the datapath.

The nat hooks are special, because they are called indirectly from the central nat dispatcher hook. They are currently invisible to the nfnl hook dump subsystem though.

But once that changes the nat ops structures have to be deferred too."

Update nf_nat_register_fn() to deal with partial exposition of the hooks from error path which can be also an issue for nfnetlink_hook.

AnalysisAI

Local privilege escalation / memory corruption in the Linux kernel's netfilter NAT subsystem (introduced in v5.14) arises because nf_nat_register_fn() freed nf_hook_ops structures immediately rather than deferring the release via RCU. Because the v5.14-era nfnetlink_hook feature lets userspace dump active netfilter hooks by peeking into the ops blob, a concurrent dump racing the NAT (un)register error path can access ops memory after it is freed. No public exploit has been identified at time of analysis and EPSS is low (0.17%), but the high-impact CVSS vector reflects a use-after-free class flaw in a core kernel subsystem.

Technical ContextAI

The flaw lives in netfilter, the in-kernel packet-filtering framework, specifically the NAT dispatcher path in net/netfilter/nf_nat_core.c. NAT hooks are special: they are invoked indirectly through a central NAT dispatcher rather than directly from the datapath's nf_hook_ops pointer array. Since v5.14 the nfnetlink_hook interface allows userspace to enumerate registered hooks by reading the original nf_hook_ops at the tail of the datapath blob. The root cause is a use-after-free / improper-lifetime-management bug (CWE-416 class; CWE listed as N/A in source data): nf_nat_register_fn() released ops synchronously instead of with kfree_rcu(), so readers traversing the structure under RCU could dereference freed memory, particularly on the registration error path where hooks are only partially exposed. The CPE data identifies the affected product generically as cpe:2.3:a:linux:linux, i.e. the mainline kernel.

RemediationAI

Vendor-released patch: upgrade to Linux kernel 6.18.33, 7.0.10, or 7.1 (or your distribution's backported equivalent), which change nf_nat_register_fn() to release ops via kfree_rcu() and correctly handle partial hook exposition on the error path. Apply the stable commits referenced above (32fdd2e3, 3c7511f3, 6eda0d77) if maintaining a custom kernel. As a compensating control where immediate patching is not possible, restrict the CAP_NET_ADMIN capability and disable unprivileged user namespaces (sysctl kernel.unprivileged_userns_clone=0 or user.max_user_namespaces=0) to prevent unprivileged users from gaining the network-admin privileges needed to register NAT hooks - note this can break containers and sandboxes (e.g. Chrome, Docker rootless) that rely on user namespaces. Where NAT/conntrack is unused, avoiding loading the nf_nat modules also removes the attack surface, at the cost of NAT functionality.

Same weakness CWE-763 – Release of Invalid Pointer or Reference

View all
CVE-2024-44852 CRITICAL POC
9.8
CVE-2020-11105 CRITICAL POC
9.8
CVE-2018-6836 CRITICAL POC
9.8
CVE-2024-6607 HIGH POC
8.8
CVE-2023-34312 HIGH POC
7.8
CVE-2022-28203 HIGH POC
7.5
CVE-2022-37451 HIGH POC
7.5
CVE-2021-21401 HIGH POC
7.1

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

EUVD-2026-38868 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy