Skip to main content

Linux Kernel EUVDEUVD-2026-59630

| CVE-2026-74565 HIGH
2026-08-15 Linux GHSA-x5cj-f9c8-r2x6
Information Disclosure Linux Red Hat Suse
7.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.0 HIGH

Race condition between namespace teardown and object lookup requires precise timing, warranting AC:H over NVD's AC:L; PR:L confirmed by need for local user account; full kernel UAF impact supports H/H/H.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
7.0 HIGH
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Red Hat
5.5 MEDIUM
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 17, 2026 - 12:30 vuln.today
CVSS changed
Aug 17, 2026 - 06:22 NVD
7.8 (HIGH)
Patch available
Aug 15, 2026 - 13:04 EUVD
CVE Published
Aug 15, 2026 - 12:28 cve.org
UNKNOWN (no severity yet)
CVE Published
Aug 15, 2026 - 12:28 cve.org
HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_tables: make nft_object rhltable per table

The nft_object rhltable is global, this allows for accessing objects that are being dismangled from lookup path by other existing netns. Given the nft_obj_destroy() releases the object inmediately, this might lead to use-after-free of these objects that are being released. Make the existing rhltable per table to address this issue to deal with with the nft_rcv_nl_event() path too.

Update nft_obj_lookup() to take the table as non-const, otherwise, compiler complains when passing the objname_ht to rhltable_lookup().

AnalysisAI

Use-after-free in the Linux kernel's nf_tables netfilter subsystem exposes local attackers with low-privilege accounts to potential kernel-level privilege escalation by exploiting a race condition in nft_object lifecycle management across network namespaces. The nft_object rhltable was implemented as a global structure, meaning that as one network namespace tears down its objects via nft_rcv_nl_event(), another namespace can still resolve pointers to those objects through the shared lookup table - and since nft_obj_destroy() frees memory immediately, a concurrent lookup dereferences freed memory. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon
Obtain local shell access
Delivery
Create network namespace with nft_objects
Exploit
Spawn concurrent thread performing nft_obj_lookup
Install
Trigger namespace teardown racing nft_obj_destroy()
C2
Dereference freed nft_object (UAF)
Execute
Heap-spray controlled payload into freed slot
Impact
Execute arbitrary kernel code as root
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires a local attacker with a low-privilege user account (confirmed by CVSS PR:L) and the ability to create and manage network namespaces - which is permitted by default for unprivileged users on most mainstream Linux distributions (Ubuntu, Fedora, Debian) unless user.max_user_namespaces is set to 0. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The NVD CVSS 3.1 score of 7.8 (High) uses AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, but the AC:L (low complexity) assignment for a race condition is potentially optimistic - race-window exploitation in the kernel typically warrants AC:H, and this discrepancy should be weighed when prioritizing. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario A local attacker with a standard unprivileged account on a container host creates a network namespace, populates it with nft_objects via nftables rules, then triggers teardown of that namespace while simultaneously flooding nft_obj_lookup() from a second namespace. If the lookup resolves a pointer to the object after nft_obj_destroy() has freed it but before the memory is overwritten, the attacker can heap-spray a controlled structure into the freed slot and redirect kernel execution to a privilege-escalation payload. …
Remediation Upgrade the Linux kernel to a patched stable release: 6.12.103, 6.18.44, or 7.1.8 depending on your active stable branch. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, inventory all Linux systems running affected kernel versions and assess exposure in containerized and multi-tenant environments, prioritizing production infrastructure. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

EUVD-2026-59630 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy