Linux Kernel EUVD-2026-45651

Exploitation requires local code execution on the host and the ability to reach the netfilter x_tables register/unregister path - in practice CAP_NET_ADMIN in the relevant network namespace - plus the capacity to unload a netfilter table module (rmmod) or otherwise trigger table teardown while concurrently issuing set/getsockopt calls against that same table. The specific trigger is the race between xt_unregister_table() teardown and userspace re-instantiation/query of the dying table. Limiting factors: it is not remotely reachable (AV:L), it needs existing privilege (PR:L, effectively net-admin), it depends on winning a timing race (a real-world reliability constraint even though CVSS marks AC:L), and it requires x_tables modules to be present/loadable - hosts with modules disabled or net-admin withheld from untrusted principals are not practically exploitable.

Signals are internally consistent for a local memory-safety bug: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H means local access and some privilege but no user interaction, with high confidentiality, integrity and availability impact - the classic profile for local privilege escalation via kernel use-after-free. EPSS is very low (0.17%, 6th percentile) and the CVE is absent from CISA KEV, indicating no observed mass exploitation. This is a real but not emergency-priority issue: exploitation realistically requires CAP_NET_ADMIN (typically root or a privileged network namespace) to drive the register/unregister path, which narrows the attacker population to already-somewhat-privileged local actors or container-escape scenarios. No SSVC decision, POC, or KEV data raises the urgency. One conflict to flag: the 'Information Disclosure' tag contradicts the C:H/I:H/A:H vector - treat this as full memory corruption, not merely an info leak, and verify against the upstream commits.

A local attacker with CAP_NET_ADMIN - for example inside a container granted network-admin, or via a low-privilege service account holding that capability - repeatedly triggers unload of a netfilter table module while a second thread hammers set/getsockopt on the same table, racing to access the table object after it is freed. By grooming the freed slab allocation they aim to convert the use-after-free into controlled kernel memory corruption and escalate to root. No public POC is currently identified, and the local, privilege-requiring, race-condition nature makes reliable exploitation non-trivial.