CVE-2026-23385

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_tables: clone set on flush only

Syzbot with fault injection triggered a failing memory allocation with

GFP_KERNEL which results in a WARN splat:

iter.err

WARNING: net/netfilter/nf_tables_api.c:845 at nft_map_deactivate+0x34e/0x3c0 net/netfilter/nf_tables_api.c:845, CPU#0: syz.0.17/5992

Modules linked in:

CPU: 0 UID: 0 PID: 5992 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full)

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026

RIP: 0010:nft_map_deactivate+0x34e/0x3c0 net/netfilter/nf_tables_api.c:845

Code: 8b 05 86 5a 4e 09 48 3b 84 24 a0 00 00 00 75 62 48 8d 65 d8 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc e8 63 6d fa f7 90 <0f> 0b 90 43

+80 7c 35 00 00 0f 85 23 fe ff ff e9 26 fe ff ff 89 d9

RSP: 0018:ffffc900045af780 EFLAGS: 00010293

RAX: ffffffff89ca45bd RBX: 00000000fffffff4 RCX: ffff888028111e40

RDX: 0000000000000000 RSI: 00000000fffffff4 RDI: 000000

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References