CVE-2023-54035: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54035 is a reference counter underflow vulnerability in the Linux kernel's netfilter nf_tables subsystem. The flaw exists in the set element addition error path, where the chain reference counter is decremented twice — once during element release and again via nft_data_release(). The vulnerability was disclosed on December 24, 2025, and affects Linux kernel versions in the range introduced by commit 628bd3e49cba up to the fixes applied in stable branches. No official CVSS score has been assigned by NVD at this time; Feedly estimates the severity as Medium (Feedly, ENISA EUVD).

The root cause is an incorrect fix introduced by commit d6b478666ffa ("netfilter: nf_tables: fix underflow in object reference counter"), which removed the stateful object reference count decrement in an attempt to address a prior double-decrement bug, but inadvertently introduced a reference counter underflow for chains (CWE classification not yet formally assigned by NVD). In the set element addition error path, nft_data_release() is responsible for decrementing the chain reference counter, but the prior incorrect fix caused the stateful object decrement to be skipped entirely. The correct fix, applied in three stable kernel commits (9c959671abc7, b068314fd8ce, b389139f12f2), restores the stateful object decrement (as originally done in b91d90368837) while allowing nft_data_release() to handle the chain reference counter decrement exactly once (Feedly, kernel.org patch 1).

A reference counter underflow in the kernel's netfilter chain management can lead to use-after-free conditions or kernel memory corruption, potentially allowing a local attacker with sufficient privileges to cause a denial of service (kernel panic/crash) or, in more severe scenarios, escalate privileges on the affected system. The impact is confined to the local system, as exploitation requires the ability to interact with nf_tables (typically requiring CAP_NET_ADMIN or equivalent). There is no known direct path to remote exploitation (Feedly).

Apply the upstream Linux kernel patches that correct the double-decrement logic in the nf_tables set element addition error path. The fixes are available in three stable kernel commits: 9c959671abc7d4ffdf34eed10c64492d43cb6a3c, b068314fd8ce751a7f906e55bb90f3551815f1a0, and b389139f12f287b8ed2e2628b72df89a081f0b59. Distributions such as SUSE have begun incorporating these fixes into their kernel packages (e.g., SUSE advisory SUSE-2026-0281-1). As a workaround where patching is not immediately possible, restricting access to CAP_NET_ADMIN capabilities (e.g., via user namespaces or seccomp policies) can reduce the attack surface (Feedly, Linux Security SUSE Advisory).