CVE-2026-23351

High · 7.8

CVSS

7.8

EPSS

0.1%

Published

Mar 25, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A problem in the Linux kernel's network tools can let someone with access to the computer make the system freeze or stop responding.

Exploitation: Local Privilege
Attacker needs: Low Privilege
Complexity: Low
Impact: Denial Of Service
Component: OS kernel
Class: Use After Free
Remediation: Patch
Effort: Medium
Patch risk: Low

What it actually does

Use-after-free in netfilter nft_set_pipapo commit-time GC when many expired elements cause prolonged non-preemptible execution, exposing freed elements to packet path and userspace dumpers before live pointer swap.

Why it matters to the business

Local denial of service via soft lockups and RCU stalls on Linux systems using nftables pipapo sets under high churn of expired elements, potentially disrupting network services and requiring reboots.

How an attack unfolds

A local attacker populates a pipapo set with a large volume of elements that expire during a single commit, forcing GC to run excessively long without preemption; this triggers stalls before the unlink/reclaim split and pointer swap can protect readers.

How to fix it

Apply the upstream fix that splits GC into unlink and reclaim phases (similar to the rbtree backend change in commit 35f83a75529a); upgrade to a Linux kernel containing the resolution for CVE-2026-23351.

How to confirm the fix worked

Verify kernel source contains the unlink/reclaim split for pipapo GC; confirm absence of soft lockup warnings under load with many expired elements; test nftables set operations post-upgrade.

Typical attack path

Obtain local shell on affected Linux kernel
Create nftables sets using the pipapo backend
Insert and expire a large number of elements in one commit cycle
Trigger set commit to force prolonged GC execution
Observe soft lockup or RCU stall resulting in local DoS

How to detect it

Review kernel logs for repeated soft lockup warnings or RCU stall reports correlated with nftables commit activity; inspect audit logs for nftables set creation and element insertion by untrusted users.

What your security team should do

Prioritize kernel updates on systems using nftables
Monitor for soft lockup and RCU stall reports in kernel logs
Limit unprivileged access to nftables where possible until patched

The record

In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_pipapo: split gc into unlink and reclaim phase Yiming Qian reports Use-after-free in the pipapo set type: Under a large number of expired elements, commit-time GC can run for a very long time in a non-preemptible context, triggering soft lockup warnings and RCU stall reports (local denial of service). We must split GC in an unlink and a reclaim phase. We cannot queue elements for freeing until pointers have been swapped. Expired elements are still exposed to both the packet path and userspace dumpers via the live copy of the data structure. call_rcu() does not protect us: dump operations or element lookups starting after call_rcu has fired can still observe the free'd element, unless the commit phase has made enough progress to swap the clone and live pointers before any new reader has picked up the old version. This a similar approach as done recently for the rbtree backend in commit 35f83a75529a ("netfilter: nft_set_rbtree: don't gc elements on insert").

Affected packages

Ecosystem	Package	Introduced	Fixed