CVE-2026-23385: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23385 is a denial-of-service vulnerability in the Linux kernel's netfilter nf_tables subsystem, specifically in the set cloning logic during flush operations. Discovered and disclosed on March 25, 2026, it affects Linux kernel versions 6.10.1 through 6.18.16, 6.19.0 through 6.19.6, the base 6.10 release, and 7.0 release candidates (rc1–rc7). The flaw was identified via Syzbot fault injection testing. It carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is improper handling of failed GFP_KERNEL memory allocations within the nft_map_deactivate function during set iteration in the netfilter table API, classified as CWE-770 (Allocation of Resources Without Limits or Throttling). When a memory allocation fails during a flush operation, the kernel emits a WARN splat at nf_tables_api.c:845, indicating an unhandled error condition in the set cloning path. The fix introduces a new NFT_ITER_UPDATE_CLONE iteration type to restrict set cloning exclusively to the flush set command in the preparation phase, and updates the rbtree and pipapo backends accordingly. Exploitation requires local access with low privileges and involves crafting netfilter operations that trigger the failing allocation path (Red Hat Bugzilla).

Successful exploitation allows a local attacker with low privileges to trigger kernel warnings (WARN splats) and system instability, resulting in a high availability impact on the affected host. There is no confidentiality or integrity impact, and the vulnerability's scope is unchanged — meaning it cannot be leveraged to directly compromise other systems or escalate privileges. The primary risk is denial of service on systems running vulnerable kernel versions that accept local user connections or execute untrusted workloads (Red Hat Advisory).

• Logs: Kernel warning messages (WARNING:) referencing nft_map_deactivate+0x34e/0x3c0 at net/netfilter/nf_tables_api.c:845 in the system kernel log (dmesg or /var/log/kern.log).
• Process: Unusual processes invoking netfilter/nftables operations (e.g., nft flush) under low-privileged user accounts, particularly in environments not expected to modify firewall rules.
• Logs: Kernel call traces involving __nft_release_table, nft_rcv_nl_event, or netlink_release appearing in conjunction with the above warning.

Upgrade to patched Linux kernel versions: 6.18.17 or later, or 6.19.7 or later. For systems running 7.0 release candidates, update to the appropriate patched 7.0 release. As a temporary workaround, restrict local system access to reduce the attack surface, particularly limiting which users can perform netfilter/nftables operations. Monitor kernel logs for WARN splats related to nft_map_deactivate as an indicator of attempted or accidental triggering. Amazon Linux 2023 users should apply update ALAS2023-2026-1596 (Red Hat Bugzilla, Amazon Linux Advisory).

Red Hat triaged the issue at medium severity and opened a public Bugzilla entry shortly after disclosure. The vulnerability was noted in the Yocto Project security mailing list and tracked by Amazon Linux for their 2023 distribution. No significant public researcher commentary or media coverage has been identified beyond standard vulnerability tracking channels (Red Hat Bugzilla).