CVE-2026-23458

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct()

ctnetlink_dump_exp_ct() stores a conntrack pointer in cb->data for the

netlink dump callback ctnetlink_exp_ct_dump_table(), but drops the

conntrack reference immediately after netlink_dump_start(). When the

dump spans multiple rounds, the second recvmsg() triggers the dump

callback which dereferences the now-freed conntrack via nfct_help(ct),

leading to a use-after-free on ct->ext.

The bug is that the netlink_dump_control has no .start or .done

callbacks to manage the conntrack reference across dump rounds. Other

dump functions in the same file (e.g. ctnetlink_get_conntrack) properly

use .start/.done callbacks for this purpose.

Fix this by adding .start and .done callbacks that hold and release the

conntrack reference for the duration of the dump, and move the

nfct_help() call after the cb->args[0] early-return check in the dump

callback to avoid

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References