CVE-2026-23391: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23391 is a use-after-free vulnerability in the Linux kernel's netfilter xt_CT module, caused by improper handling of pending enqueued packets when a connection tracking template rule is removed. The flaw was disclosed on March 25, 2026, and affects Linux kernel versions from 3.4 through multiple stable branches up to 6.19.x and 7.0 release candidates. Affected version ranges include 3.4.1–5.10.253, 5.11–5.15.203, 5.16–6.1.167, 6.2–6.6.130, 6.7–6.12.78, 6.13–6.18.20, and 6.19–6.19.10, as well as 7.0-rc1 through rc4. It carries a CVSS v3.1 base score of 7.8 (High), exploitable locally with low privileges (Red Hat CVE, Feedly).

The root cause is classified as CWE-911 (Improper Update of Reference Count), manifesting as a use-after-free condition in the netfilter: xt_CT subsystem. When a netfilter connection tracking template rule is removed, packets already sitting in nfqueue may still hold references to objects associated with that template — specifically, helper modules (which can be freed on module removal) or timeout policies (which can be removed via nfnetlink_cttimeout). Because the kernel does not flush these pending enqueued packets upon template removal, a dangling pointer dereference can occur when those packets are subsequently processed. The fix involves explicitly flushing enqueued packets when the template rule is removed, preventing access to freed memory (Red Hat CVE, Kernel Commits).

Successful exploitation could result in kernel crashes (denial of service), memory corruption, or potential privilege escalation from a low-privileged local user to kernel-level access. The CVSS assessment rates confidentiality, integrity, and availability impacts all as High, reflecting the severity of kernel memory corruption. An attacker with local access who can manipulate netfilter rules and trigger packet queuing could leverage this flaw to destabilize the system or escalate privileges, potentially affecting all processes running on the host (Red Hat CVE, Feedly).

Patches are available across multiple Linux kernel stable branches. Administrators should upgrade to the following fixed versions: 5.10.253+, 5.15.203+, 6.1.167+, 6.6.130+, 6.12.78+, 6.18.20+, 6.19.10+, or 7.0-rc5+. Upstream kernel commits addressing the issue include 19a230dec6bb, 55445134d42b, 63b8097cea19, 777d02efe3d6, cb549925875f, cc57506dd665, d2d0bae0c9a2, and f62a218a946b. Where immediate patching is not feasible, restrict local user access and consider unloading or disabling the xt_CT netfilter module if it is not required for production operations (Red Hat CVE, Feedly). Distribution-specific updates have been issued by Red Hat, SUSE, Debian, and Amazon Linux (SUSE Advisory, Amazon Linux).

Red Hat published a CVE advisory and associated Bugzilla entry shortly after disclosure on March 25, 2026. Microsoft also acknowledged the vulnerability in their update guide, reflecting its relevance to Azure Linux kernel deployments. Debian, SUSE, and Amazon Linux have all issued distribution-specific security updates. Community tracking has been noted on platforms including Bluesky and various CVE aggregator feeds, though no significant researcher commentary or media coverage beyond standard vulnerability tracking has been observed (Red Hat CVE, SUSE Advisory, Amazon Linux).