CVE-2026-23272

Estado: ModificadaAlta (7.8)—

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_tables: unconditionally bump set->nelems before insertion

In case that the set is full, a new element gets published then removed without waiting for the RCU grace period, while RCU reader can be walking over it already.

To address this issue, add the element transaction even if set is full, but toggle the set_full flag to report -ENFILE so the abort path safely unwinds the set to its previous state.

As for element updates, decrement set->nelems to restore it.

A simpler fix is to call synchronize_rcu() in the error path. However, with a large batch adding elements to already maxed-out set, this could cause noticeable slowdown of such batches.

CVSS

Versión: 3.1
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Puntuación base: 7.8

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 0.12%
Percentil entre todas las CVEs puntuadas: 2
Fecha de la puntuación: 6/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

ExplotaciónT1068 Exploitation for Privilege Escalationprivilege escalation60 %

Inferido por reglas deterministas a partir del vector CVSS y la CWE. Solo orientativo.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Threat Intelligence Program Execution Prevention Application Isolation and Sandboxing Exploit Protection Update Software

Tecnologías afectadas (1)

Linux — Linux Kernel

CWE

NVD-CWE-noinfo

Referencias

JSON original (NVD)

Mostrar

{
  "id": "CVE-2026-23272",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "35d0ac9070ef619e3bf44324375878a1c540387b",
              "lessThan": "25fcaef7948912652905e96922f36583a84fffed",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "35d0ac9070ef619e3bf44324375878a1c540387b",
              "lessThan": "e3ccb11fc8249759d23326038c8db987ddaabc77",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "35d0ac9070ef619e3bf44324375878a1c540387b",
              "lessThan": "86bc4b1a0f672d47ac19f9022432cb6a2e01cb33",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "35d0ac9070ef619e3bf44324375878a1c540387b",
              "lessThan": "6826131c7674329335ca25df2550163eb8a1fd0c",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "35d0ac9070ef619e3bf44324375878a1c540387b",
              "lessThan": "ccb8c8f3c1127cf34d18c737309897c68046bf21",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "35d0ac9070ef619e3bf44324375878a1c540387b",
              "lessThan": "def602e498a4f951da95c95b1b8ce8ae68aa733a",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "fefdd79403e89b0c673965343b92e2e01e2713a8",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "4.9.33",
              "lessThan": "4.10",
              "versionType": "semver"
            }
          ],
          "programFiles": [
            "net/netfilter/nf_tables_api.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.10"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "4.10",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "6.1.177",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.141",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.91",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.17",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "6.19.7",
              "versionType": "semver",
              "lessThanOrEqual": "6.19.*"
            },
            {
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "net/netfilter/nf_tables_api.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-03-20T09:16:12.700",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/25fcaef7948912652905e96922f36583a84fffed",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/6826131c7674329335ca25df2550163eb8a1fd0c",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/86bc4b1a0f672d47ac19f9022432cb6a2e01cb33",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/ccb8c8f3c1127cf34d18c737309897c68046bf21",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/def602e498a4f951da95c95b1b8ce8ae68aa733a",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/e3ccb11fc8249759d23326038c8db987ddaabc77",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: unconditionally bump set->nelems before insertion\n\nIn case that the set is full, a new element gets published then removed\nwithout waiting for the RCU grace period, while RCU reader can be\nwalking over it already.\n\nTo address this issue, add the element transaction even if set is full,\nbut toggle the set_full flag to report -ENFILE so the abort path safely\nunwinds the set to its previous state.\n\nAs for element updates, decrement set->nelems to restore it.\n\nA simpler fix is to call synchronize_rcu() in the error path.\nHowever, with a large batch adding elements to already maxed-out set,\nthis could cause noticeable slowdown of such batches."
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nnetfilter: nf_tables: incrementar incondicionalmente set-&gt;nelems antes de la inserción\n\nEn caso de que el conjunto esté lleno, se publica un nuevo elemento que luego se elimina sin esperar el período de gracia de RCU, mientras que un lector de RCU ya puede estar recorriéndolo.\n\nPara abordar este problema, añadir la transacción del elemento incluso si el conjunto está lleno, pero alternar la bandera set_full para informar -ENFILE de modo que la ruta de aborto deshaga de forma segura el conjunto a su estado anterior.\n\nEn cuanto a las actualizaciones de elementos, decrementar set-&gt;nelems para restaurarlo.\n\nUna solución más simple es llamar a synchronize_rcu() en la ruta de error.\nSin embargo, con un gran lote añadiendo elementos a un conjunto ya agotado, esto podría causar una ralentización notable de dichos lotes."
    }
  ],
  "lastModified": "2026-07-04T12:16:54.653",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EEE0D9A1-4C7E-48E7-A9AF-94665FE9075B",
              "versionEndExcluding": "4.10",
              "versionStartIncluding": "4.9.33"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EDFCFD07-2965-4650-8296-7B0C3DE7DCA3",
              "versionEndExcluding": "6.18.17",
              "versionStartIncluding": "4.10.1"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "69245D10-0B71-485E-80C3-A64F077004D3",
              "versionEndExcluding": "6.19.7",
              "versionStartIncluding": "6.19"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:4.10:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C201E405-86F2-4F96-984A-00A865219C86"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:4.10:rc6:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "09B6110F-7933-484D-AEAF-5D15FF38647E"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:4.10:rc7:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "75694C52-0ADF-45EC-80AC-D973535B5CB9"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:4.10:rc8:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "29F29665-6B16-4D9F-A417-D0743395DF01"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}