CVE-2026-23351: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23351 is a use-after-free vulnerability in the Linux kernel's netfilter nft_set_pipapo garbage collection (GC) mechanism. Reported by Yiming Qian, the flaw arises because commit-time GC does not properly split the unlink and reclaim phases, allowing concurrent readers (packet path and userspace dumpers) to observe freed elements. It was published on March 25, 2026, and affects Linux kernel versions from 5.6 through multiple stable branches up to 6.19.x and 7.0-rc variants. It carries a CVSS v3.1 base score of 7.8 (High) (Red Hat CVE, Red Hat Bugzilla).

The root cause is classified as CWE-416 (Use After Free) and CWE-825 (Expired Pointer Dereference). During commit-time garbage collection in the pipapo set type, expired elements are queued for freeing via call_rcu() before the live and clone data structure pointers are swapped. This creates a race window where packet-path lookups or userspace dump operations starting after call_rcu() fires can still dereference the freed element memory, because the commit phase may not have progressed far enough to swap pointers before a new reader picks up the old version. Under a large number of expired elements, GC also runs for an extended time in a non-preemptible context, triggering soft lockup warnings and RCU stall reports. The fix mirrors the approach taken for the rbtree backend in commit 35f83a75529a by splitting GC into a distinct unlink phase (pointer swap) followed by a separate reclaim phase (Red Hat CVE, Kernel Patches).

Exploitation by a low-privileged local attacker can result in kernel crashes (system-wide denial of service), soft lockup warnings, and RCU stall reports affecting all users on the system. The use-after-free condition also creates a potential for kernel memory disclosure (confidentiality impact) and memory corruption (integrity impact), which in the worst case could be leveraged for local privilege escalation. The vulnerability affects the availability of the entire system and any workloads running on it (Red Hat CVE).

• Logs: Kernel logs (dmesg, /var/log/kern.log) showing soft lockup warnings (e.g., BUG: soft lockup - CPU#X stuck for Xs) or RCU stall reports (e.g., INFO: rcu_sched detected stalls) associated with netfilter/nftables activity.
• Logs: Kernel oops or panic messages referencing nft_set_pipapo or related netfilter GC code paths.
• Process: Unusual or prolonged CPU usage by kernel threads handling netfilter commit-time garbage collection in a non-preemptible context.
• System Behavior: Unexpected system hangs or reboots on hosts with active nftables rule sets containing large numbers of expiring set elements.

Patches are available across all affected stable kernel branches. Administrators should upgrade to one of the following fixed versions: 5.10.253, 5.15.203, 6.1.167, 6.6.130, 6.12.77, 6.18.17, or 6.19.7. Individual stable commits are available at kernel.org. Red Hat, Microsoft (Azure Linux 3), Debian, Ubuntu, SUSE, and Amazon Linux have all published distribution-specific advisories and updated packages. As a temporary workaround where kernel updates cannot be applied immediately, restrict the creation and management of large netfilter nftables rule sets with expiring elements to trusted administrators, or disable the nft_set_pipapo functionality if not operationally required (Red Hat CVE, Red Hat Bugzilla, Microsoft MSRC).

Red Hat, Microsoft, Debian, Ubuntu, SUSE, and Amazon Linux have all issued patch advisories, reflecting broad vendor acknowledgment of the issue. The vulnerability was detected by multiple commercial scanners including Qualys and Nessus, indicating rapid integration into enterprise vulnerability management tooling. No notable independent researcher commentary or significant social media discussion has been identified beyond standard vendor patch notifications.