Description
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_tables: fix use-after-free in nf_tables_addchain()
nf_tables_addchain() publishes the chain to table->chains via
list_add_tail_rcu() (in nft_chain_add()) before registering hooks.
If nf_tables_register_hook() then fails, the error path calls
nft_chain_del() (list_del_rcu()) followed by nf_tables_chain_destroy()
with no RCU grace period in between.
This creates two use-after-free conditions:
1) Control-plane: nf_tables_dump_chains() traverses table->chains
under rcu_read_lock(). A concurrent dump can still be walking
the chain when the error path frees it.
2) Packet path: for NFPROTO_INET, nf_register_net_hook() briefly
installs the IPv4 hook before IPv6 registration fails. Packets
entering nft_do_chain() via the transient IPv4 hook can still be
dereferencing chain->blob_gen_X when the error path frees the
chain.
Add synchronize_rcu() between nft_chain_del() and the chain destroy
so that all RCU readers -- both dump threads and in-flight packet
evaluation -- have finished before the chain is freed.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Linux | Linux | 3.16 | 6.1.165 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | linux | 6.18.14-1 | — |
| Debian 13 | linux | 6.12.85-1 | — |
| Debian 12 | linux | 6.1.170-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Nvidia-BlueField 24.04 LTS | linux-bluefield | 6.8.0-1022.26 | — |
| Ubuntu 25.10 | linux | 6.17.0-23.23 | — |
| Ubuntu 25.10 | linux-aws +2 | 6.17.0-1013.13 | USN-8245-1 |
| Ubuntu 25.10 | linux-azure-fde | No fix yet | — |
| Ubuntu 25.10 | linux-oracle | 6.17.0-1012.12 | — |
| Ubuntu 25.10 | linux-raspi | 6.17.0-1014.14 | — |
| Ubuntu 25.10 | linux-realtime | 6.17.0-1011.12 | — |
| Ubuntu 25.10 | linux-riscv | 6.17.0-23.23.1 | — |
| Ubuntu 24.04 LTS | linux | 6.8.0-111.111 | USN-8254-1 |
| Ubuntu 24.04 LTS | linux-aws | 6.8.0-1053.56 | USN-8254-1 |
| Ubuntu 24.04 LTS | linux-aws-6.17 +2 | 6.17.0-1013.13~24.04.1 | USN-8245-1 |
| Ubuntu 24.04 LTS | linux-azure | 6.8.0-1054.60 | USN-8258-1 |
| Ubuntu 24.04 LTS | linux-azure-fde | 6.8.0-1058.65 | — |
| Ubuntu 24.04 LTS | linux-azure-nvidia | 6.8.0-1039.42 | — |
| Ubuntu 24.04 LTS | linux-gcp | 6.8.0-1055.58 | USN-8254-1 |
| Ubuntu 24.04 LTS | linux-gke | 6.8.0-1051.57 | USN-8254-1 |
| Ubuntu 24.04 LTS | linux-gkeop | 6.8.0-1038.41 | USN-8254-1 |
| Ubuntu 24.04 LTS | linux-hwe-6.17 | 6.17.0-23.23~24.04.1 | — |
| Ubuntu 24.04 LTS | linux-ibm | 6.8.0-1052.52 | USN-8254-1 |
| Ubuntu 24.04 LTS | linux-lowlatency | 6.8.0-111.111.1 | USN-8254-1 |
| Ubuntu 24.04 LTS | linux-nvidia | 6.8.0-1052.55 | — |
| Ubuntu 24.04 LTS | linux-nvidia-6.17 | 6.17.0-1026.26 | USN-8508-1 |
| Ubuntu 24.04 LTS | linux-nvidia-lowlatency | 6.8.0-1052.55.1 | — |
| Ubuntu 24.04 LTS | linux-nvidia-tegra | 6.8.0-1023.23 | — |
| Ubuntu 24.04 LTS | linux-oem-6.17 | 6.17.0-1020.20 | USN-8245-1 |
| Ubuntu 24.04 LTS | linux-oracle | 6.8.0-1050.51 | USN-8254-1 |
| Ubuntu 24.04 LTS | linux-oracle-6.17 | 6.17.0-1014.14~24.04.1 | — |
| Ubuntu 24.04 LTS | linux-raspi | 6.8.0-1053.57 | USN-8254-1 |
| Ubuntu 24.04 LTS | linux-riscv +18 | No fix yet | — |
| Ubuntu 24.04 LTS | linux-riscv-6.17 | 6.17.0-23.23.1~24.04.1 | — |
| Ubuntu 24.04 LTS | linux-xilinx | 6.8.0-1029.30 | USN-8261-1 |
| Ubuntu 22.04 LTS | linux-aws-6.8 | 6.8.0-1053.56~22.04.1 | USN-8254-1 |
| Ubuntu 22.04 LTS | linux-azure-6.8 | 6.8.0-1059.65~22.04.1 | USN-8440-1 |
| Ubuntu 22.04 LTS | linux-azure-fde-6.8 | 6.8.0-1058.65~22.04.1 | — |
| Ubuntu 22.04 LTS | linux-gcp-6.8 | 6.8.0-1060.63~22.04.1 | — |
| Ubuntu 22.04 LTS | linux-hwe-6.8 +1 | 6.8.0-111.111~22.04.1 | USN-8254-1 |
| Ubuntu 22.04 LTS | linux-ibm-6.8 | 6.8.0-1052.52~22.04.1 | USN-8254-1 |
| Ubuntu 22.04 LTS | linux-lowlatency-hwe-6.8 | 6.8.0-111.111.1~22.04.1 | USN-8254-1 |
| Ubuntu 22.04 LTS | linux-nvidia-6.8 | 6.8.0-1052.55~22.04.1 | — |
| Ubuntu 22.04 LTS | linux-oracle-6.8 | 6.8.0-1050.51~22.04.1 | USN-8254-1 |
| Ubuntu 22.04 LTS | linux-riscv +32 | No fix yet | — |
| Ubuntu 20.04 LTS | linux-gke +28 | No fix yet | — |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | linux-gcp +14 | No fix yet | — |
| Ubuntu 16.04 LTS | linux-hwe-edge | No fix yet | — |
| Ubuntu Pro Realtime 24.04 LTS | linux-raspi-realtime | 6.8.0-2043.44 | USN-8254-1 |
| Ubuntu Pro Realtime 24.04 LTS | linux-realtime | 6.8.1-1048.49 | USN-8254-1 |
| Ubuntu Pro Realtime 24.04 LTS | linux-realtime-6.14 | No fix yet | — |
| Ubuntu Pro Realtime 24.04 LTS | linux-realtime-6.17 | 6.17.0-1011.12~24.04.1 | — |
| Ubuntu Pro Realtime 22.04 LTS | linux-realtime-6.8 | 6.8.1-1048.49~22.04.1 | USN-8254-1 |
| Ubuntu Pro FIPS-updates 24.04 LTS | linux-aws-fips | 6.8.0-1053.56+fips1 | USN-8254-1 |
| Ubuntu Pro FIPS-updates 24.04 LTS | linux-azure-fips | 6.8.0-1054.60+fips1 | — |
| Ubuntu Pro FIPS-updates 24.04 LTS | linux-fips | 6.8.0-111.111+fips1 | USN-8254-1 |
| Ubuntu Pro FIPS-updates 24.04 LTS | linux-gcp-fips | 6.8.0-1055.58+fips1 | USN-8254-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | rv +76 | 6.12.0-124.47.1.el10_1 | RHSA-2026:6053 |
| RHEL 9 | rv +75 | 5.14.0-611.47.1.el9_7 | RHSA-2026:6570 |
| RHEL 8 | kernel-rt +12 | 4.18.0-553.117.1.rt7.458.el8_10 | RHSA-2026:6572 |
| RHEL 8 | perf +26 | 4.18.0-553.117.1.el8_10 | RHSA-2026:6571 |
Show 15 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Extras Rt Els 7 | kernel-rt +7 | 3.10.0-1160.148.1.rt56.1300.el7 | RHSA-2026:10756 |
| RHEL 10.0 EUS | rv +77 | 6.12.0-55.69.1.el10_0 | RHSA-2026:9095 |
| RHEL 9.6 EUS | rv +77 | 5.14.0-570.106.1.el9_6 | RHSA-2026:6940 |
| RHEL 9.4 EUS | bpftool | 7.3.0-427.121.1.el9_4 | RHSA-2026:10108 |
| RHEL 9.4 EUS | rv +64 | 5.14.0-427.121.1.el9_4 | RHSA-2026:10108 |
| RHEL 9.2 E4S | bpftool | 7.0.0-284.166.1.el9_2 | RHSA-2026:9644 |
| RHEL 9.2 E4S | kernel-rt +14 | 5.14.0-284.166.1.rt14.451.el9_2 | RHSA-2026:9512 |
| RHEL 9.2 E4S | perf +47 | 5.14.0-284.166.1.el9_2 | RHSA-2026:9644 |
| RHEL 9.0 E4S | kernel-rt +12 | 5.14.0-70.175.1.rt21.247.el9_0 | RHSA-2026:9835 |
| RHEL 9.0 E4S | perf +28 | 5.14.0-70.175.1.el9_0 | RHSA-2026:9836 |
| RHEL 8.8 TUS | perf +17 | 4.18.0-477.136.1.el8_8 | RHSA-2026:9515 |
| RHEL 8.8 E4S | perf +18 | 4.18.0-477.136.1.el8_8 | RHSA-2026:9515 |
| RHEL 8.6 TUS | perf +17 | 4.18.0-372.188.1.el8_6 | RHSA-2026:9514 |
| RHEL 8.6 E4S | perf +25 | 4.18.0-372.188.1.el8_6 | RHSA-2026:9514 |
| RHEL 8.6 AUS | perf +17 | 4.18.0-372.188.1.el8_6 | RHSA-2026:9514 |
| RHEL 8.4 EUS Long Life | perf +17 | 4.18.0-305.189.1.el8_4 | RHSA-2026:9643 |
| RHEL 8.4 AUS | perf +17 | 4.18.0-305.189.1.el8_4 | RHSA-2026:9643 |
| RHEL 8.2 AUS | perf +17 | 4.18.0-193.195.1.el8_2 | RHSA-2026:9513 |
| RHEL 7 ELS | perf +18 | 3.10.0-1160.148.1.el7 | RHSA-2026:9870 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | kernel-doc +1 | 6.12.0-124.47.1.el10_1 | ALSA-2026:6053 |
| AlmaLinux 9 | rv +73 | 5.14.0-611.47.1.el9_7 | ALSA-2026:6570 |
| AlmaLinux 8 | kernel-rt +9 | 4.18.0-553.117.1.rt7.458.el8_10 | ALSA-2026:6572 |
| AlmaLinux 8 | perf +24 | 4.18.0-553.117.1.el8_10 | ALSA-2026:6571 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | kernel | 6.12.0-124.47.1.el10_1 | RLSA-2026:6053 |
| Rocky Linux 9 | kernel | 5.14.0-611.47.1.el9_7 | RLSA-2026:6570 |
| Rocky Linux 8 | kernel | 4.18.0-553.117.1.el8_10 | RLSA-2026:6571 |
| Rocky Linux 8 | kernel-rt | 4.18.0-553.117.1.rt7.458.el8_10 | RLSA-2026:6572 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLE Micro 6.2 | gdk-pixbuf | 2.42.12-160000.4.1 | SUSE-SU-2026:21230-1 |
| SLE Micro 6.2 | kernel-default-base | 6.12.0-160000.27.1.160000.2.8 | SUSE-SU-2026:21237-1 |
| SLE Micro 6.2 | kernel-rt +5 | 6.12.0-160000.28.1 | SUSE-SU-2026:21237-1, SUSE-SU-2026:21230-1 |
| SLE Micro 6.1 | kernel-default-base | 6.4.0-41.1.21.18 | SUSE-SU-2026:21114-1 |
| SLE Micro 6.1 | kernel-rt +4 | 6.4.0-41.1 | SUSE-SU-2026:21255-1, SUSE-SU-2026:21114-1 |
| SLE Micro 6.0 | kernel-default-base | 6.4.0-41.1.21.18 | SUSE-SU-2026:21123-1 |
| SLE Micro 6.0 | kernel-source +2 | 6.4.0-41.1 | SUSE-SU-2026:21123-1 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLE Live Patching 15 SP7 | kernel-livepatch-SLE15-SP7-RT_Update_11 | 1-150700.1.3.1 | SUSE-SU-2026:1573-1 |
| SUSE Real Time Module 15 SP7 | kernel-rt +1 | 6.4.0-150700.7.37.2 | SUSE-SU-2026:1573-1 |
| SUSE Real Time Module 15 SP7 | kernel-syms-rt | 6.4.0-150700.7.37.1 | SUSE-SU-2026:1573-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | kernel-source | 6.19.8-1.1 | openSUSE-SU-2026:10387-1 |
| openSUSE Leap 16.0 | kernel-default-base | 6.12.0-160000.27.1.160000.2.8 | openSUSE-SU-2026:20572-1 |
| openSUSE Leap 16.0 | kernel-rt +11 | 6.12.0-160000.28.1 | openSUSE-SU-2026:20572-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | kernel-livepatch-6.12.77-99.140 +1 | 1:1.0-0.amzn2023 | ALAS2023-2026-1544, ALAS2023-2026-1543 |
| Amazon Linux 2023 | perf +14 | 1:6.1.166-197.305.amzn2023 | ALAS2023-2026-1544 |
| Amazon Linux 2023 | perf6.12 +14 | 1:6.12.77-99.140.amzn2023 | ALAS2023-2026-1543 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | kernel | 6.6.130.1-1 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | rv +29 | 6.12.0-124.47.1.el10_1 | ELSA-2026-6053 |
| Oracle Linux 9 | kernel-uek +34 | 6.12.0-200.74.27.2.el10uek | ELSA-2026-50372, ELSA-2026-50232, ELSA-2026-50184 |
| Oracle Linux 9 | rv +28 | 5.14.0-611.47.1.el9_7 | ELSA-2026-6570 |
| Oracle Linux 8 | perf +19 | 4.18.0-553.117.1.el8_10 | ELSA-2026-6571 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 1
- Linux nf_tables 6.19.3 - Local Privilege Escalation EDB-52549 · local · May 4, 2026
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 50
- SSA-457936 SSA-457936: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1.7 Siemens ProductCERT · Nov 10, 2026
- USN-8440-1 linux-azure-6.8 vulnerabilities Ubuntu Security Notices (USN) · Nov 7, 2026
- USN-8508-1 linux-nvidia-6.17 vulnerabilities Ubuntu Security Notices (USN) · Nov 7, 2026
- ELSA-2026-50184 Important: Unbreakable Enterprise kernel security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Nov 6, 2026
- USN-8258-1 linux-azure vulnerabilities Ubuntu Security Notices (USN) · Nov 4, 2026
- USN-8245-1 linux-azure, linux-azure-6.17, linux-oem-6.17 vulnerabilities Ubuntu Security Notices (USN) · Nov 4, 2026
- ALSA-2026:6570 Moderate: kernel security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:6053 Moderate: kernel security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:6571 Moderate: kernel security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:6572 Moderate: kernel-rt security update AlmaLinux Security Advisories · Oct 29, 2026
- ICSA-26-295-16 Siemens SIMATIC S7-1500 TM MFP CISA ICS & IT advisories · Oct 22, 2026
- ICSA-26-295-11 Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP CISA ICS & IT advisories · Oct 22, 2026
- WID-SEC-2026-3891 Siemens SIMATIC S7: Mehrere Schwachstelle BSI CERT-Bund (WID) · Oct 18, 2026
- SSA-082556 SSA-082556: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1.5 Siemens ProductCERT · Oct 13, 2026
- SSA-784472 SSA-784472: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 TM MFP V1.1.1 Siemens ProductCERT · Oct 13, 2026
- SSA-019113 SSA-019113: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1.6 Siemens ProductCERT · Oct 13, 2026
- USN-8254-1 linux, linux-aws, linux-aws-6.8, linux-aws-fips, linux-fips, linux-gcp, linux-gcp-fips, linux-gke, linux-gkeop, linux-hwe-6.8, linux-ibm, linux-ibm-6.8, linux-lowlatency, linux-lowlatency-hwe-6.8, linux-oracle, linux-oracle-6.8, linux-raspi, linux-raspi-realtime, linux-realtime, linux-realtime-6.8 vulnerabilities Ubuntu Security Notices (USN) · Oct 8, 2026
- RHSA-2026:6570 Red Hat Security Advisory: kernel security update Red Hat Security Advisories (RHSA) · Oct 6, 2026
- RHSA-2026:10108 Red Hat Security Advisory: kernel security update Red Hat Security Advisories (RHSA) · Oct 6, 2026
- WID-SEC-2026-0614 Linux Kernel: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 21, 2026
- RHSA-2026:9870 Red Hat Security Advisory: kernel security update Red Hat Security Advisories (RHSA) · Sep 11, 2026
- RHSA-2026:9835 Red Hat Security Advisory: kernel-rt security update Red Hat Security Advisories (RHSA) · Sep 11, 2026
- RHSA-2026:9836 Red Hat Security Advisory: kernel security update Red Hat Security Advisories (RHSA) · Sep 11, 2026
- RHSA-2026:9644 Red Hat Security Advisory: kernel security update Red Hat Security Advisories (RHSA) · Sep 11, 2026
- RHSA-2026:9515 Red Hat Security Advisory: kernel security update Red Hat Security Advisories (RHSA) · Sep 11, 2026
- RHSA-2026:9643 Red Hat Security Advisory: kernel security update Red Hat Security Advisories (RHSA) · Sep 11, 2026
- RHSA-2026:9514 Red Hat Security Advisory: kernel security update Red Hat Security Advisories (RHSA) · Sep 11, 2026
- RHSA-2026:9512 Red Hat Security Advisory: kernel-rt security update Red Hat Security Advisories (RHSA) · Sep 11, 2026
- RHSA-2026:9513 Red Hat Security Advisory: kernel security update Red Hat Security Advisories (RHSA) · Sep 11, 2026
- RHSA-2026:9095 Red Hat Security Advisory: kernel security update Red Hat Security Advisories (RHSA) · Sep 11, 2026
- RHSA-2026:6940 Red Hat Security Advisory: kernel security update Red Hat Security Advisories (RHSA) · Sep 11, 2026
- RHSA-2026:6572 Red Hat Security Advisory: kernel-rt security update Red Hat Security Advisories (RHSA) · Sep 11, 2026
- RHSA-2026:6571 Red Hat Security Advisory: kernel security update Red Hat Security Advisories (RHSA) · Sep 11, 2026
- RHSA-2026:6053 Red Hat Security Advisory: kernel security update Red Hat Security Advisories (RHSA) · Sep 11, 2026
- RHSA-2026:10756 Red Hat Security Advisory: kernel-rt security update Red Hat Security Advisories (RHSA) · Sep 11, 2026
- USN-8261-1 linux-xilinx vulnerabilities Ubuntu Security Notices (USN) · Sep 7, 2026
- ICSA-26-209-04 Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP CISA ICS & IT advisories · Jul 28, 2026
- SUSE-SU-2026:21230-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Jul 9, 2026
- ICSA-26-188-05 Siemens SINEC OS CISA ICS & IT advisories · Jul 7, 2026
- ELSA-2026-50372 Important: Unbreakable Enterprise kernel security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Jul 2, 2026
- ALAS2023-2026-1543 Important: kernel6.12 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Jun 16, 2026
- ALAS2023-2026-1544 Important: kernel security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Jun 16, 2026
- SSA-253495 SSA-253495: Multiple Vulnerabilities in SINEC OS before V4.0 Siemens ProductCERT · Jun 2, 2026
- SUSE-SU-2026:21255-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Apr 24, 2026
- SUSE-SU-2026:1573-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Apr 24, 2026
- SUSE-SU-2026:21237-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Apr 23, 2026
- openSUSE-SU-2026:20572-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Apr 22, 2026
- SUSE-SU-2026:21123-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Apr 18, 2026
- SUSE-SU-2026:21114-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Apr 18, 2026
- ELSA-2026-50232 Important: Unbreakable Enterprise kernel security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Apr 15, 2026
References
- https://git.kernel.org/stable/c/2a6586ecfa4ce1413daaafee250d2590e05f1a33
- https://git.kernel.org/stable/c/7017745068a9068904e1e7a1b170a5785647cc81
- https://git.kernel.org/stable/c/f3fe58ce37926a10115ede527d59b91bcc05400a
- https://git.kernel.org/stable/c/dbd0af8083dd201f07c49110b2ee93710abdff28
- https://git.kernel.org/stable/c/2f9a4ffeb763aec822f8ff3d1e82202d27d46d4b
- https://git.kernel.org/stable/c/71e99ee20fc3f662555118cf1159443250647533