CVE-2023-54200: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54200 is a use-after-free vulnerability in the Linux kernel's netfilter nf_tables subsystem, specifically in the handling of netdev hooks during network namespace (netns) teardown. The flaw was introduced by a prior commit that skipped netdev events generated during netns removal, which created a race condition when veth peer devices are released. It affects Linux kernel versions from 5.15 through at least 6.3.x, with fixes backported to stable releases including 5.15.113, 6.1.30, 6.3.4, and 6.4. The vulnerability was published on December 30, 2025, and carries an estimated CVSS severity of Medium (Feedly, EUVD).

The root cause is a use-after-free (CWE-416) in the nf_hook_entry_head() function within the netfilter nf_tables netdev hook management code. When a veth device is deleted, veth_dellink() queues the peer network namespace device for removal. If the peer netns is also being torn down concurrently, the peer netns device memory may be freed before the nf_tables_pre_exit_net pre-exit hook runs, which then calls nft_netdev_unregister_hooks on already-freed memory. The fix reverts the earlier commit "netfilter: nf_tables: skip netdev events generated on netns removal" and ensures netdev hooks are always released from the notifier path, preventing the stale memory access. The KASAN report identifies the read of freed memory at nf_hook_entry_head+0x1b8/0x1d0 triggered by a kworker during cleanup_net (Feedly).

Successful exploitation of this vulnerability can cause a kernel crash (denial of service) due to the use-after-free condition triggered during concurrent netns and veth device teardown. In more severe scenarios, use-after-free bugs in the kernel can potentially be leveraged for local privilege escalation, though no such exploitation has been publicly demonstrated for this specific CVE. The vulnerability primarily affects systems using veth pairs and nf_tables netdev hooks in containerized or virtualized environments where multiple network namespaces are destroyed concurrently (Feedly).

• Logs: Kernel logs (dmesg or /var/log/kern.log) showing KASAN reports such as BUG: KASAN: slab-use-after-free in nf_hook_entry_head+0x1b8/0x1d0 with a call trace involving nft_netdev_unregister_hooks, __nft_release_hook, and nf_tables_pre_exit_net.
• Process: Workqueue task kworker/u*:*/cleanup_net appearing in stack traces associated with kernel panics or KASAN splats during container or network namespace teardown.
• System Behavior: Unexpected kernel crashes or system instability occurring specifically during concurrent destruction of veth-connected network namespaces with active nf_tables netdev hooks.

The fix has been backported to multiple stable Linux kernel releases: 5.15.113, 6.1.30, 6.3.4, and 6.4. Administrators should update to these or later stable kernel versions. The patch reverts the commit "netfilter: nf_tables: skip netdev events generated on netns removal" (commit 68a3765c659f) and ensures netdev hooks are always released via the notifier. As a workaround where patching is not immediately possible, avoiding concurrent teardown of veth-connected network namespaces with active nf_tables netdev rules may reduce exposure (Feedly, Kernel Patch 5.15, Kernel Patch 6.1).