CVE-2026-23399: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23399 is a memory leak vulnerability in the Linux kernel's nf_tables subsystem, specifically in the nft_dynset functionality. When cloning a second stateful expression during element creation fails due to a GFP_ATOMIC memory allocation failure, the first stateful expression is not properly released, leaving unreferenced per-CPU memory allocated in the kernel. The vulnerability affects Linux kernel versions from 5.11.1 through 6.12.77, 6.13.0 through 6.18.19, and 6.19.0 through 6.19.9, as well as 7.0 release candidates. It was published on March 28, 2026, and carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly, EUVD).

The root cause is classified as CWE-401 (Missing Release of Memory after Effective Lifetime). The flaw resides in the nft_dynset_new() function within the nf_tables kernel module: when two stateful expressions are being cloned for a new dynamic set element and the second clone fails (e.g., nft_counter_clone() via pcpu_alloc_noprof()), the error path does not release the already-allocated first expression, resulting in a per-CPU memory leak. The call chain involved is nft_dynset_eval → nft_rhash_update → nft_dynset_new → nft_expr_clone → nft_counter_clone. Exploitation requires local access and the ability to trigger netfilter/nf_tables operations under memory pressure conditions (Feedly, EUVD).

The primary impact is a denial of service through gradual kernel memory exhaustion. A local attacker with sufficient privileges to configure or trigger nf_tables rules can repeatedly induce the error condition during network packet processing, causing the kernel to accumulate unreferenced per-CPU memory allocations over time, ultimately degrading system performance or causing instability. There is no confidentiality or integrity impact; the vulnerability is limited to availability (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.018%, reflecting a very low probability of exploitation in the near term. Exploitation requires local access with privileges to interact with nf_tables, limiting the attack surface (Feedly).

Patches are available in Linux kernel versions 6.12.78, 6.18.20, and 6.19.10 or later, as well as in the 7.0-rc5 release candidate. Upstream fixes are available at the following kernel.org commits: 0548a13b, 31641c68, c88a9fd2, and d1354873. Downstream distributions including Debian, Amazon Linux 2023, SUSE, and openSUSE have issued updated packages. If immediate patching is not possible, restrict local access to affected systems and limit nf_tables rule configuration to trusted administrators only; disabling nf_tables if not required is also an option (Feedly, Amazon Advisory, SUSE Advisory).

The vulnerability was announced via the Linux kernel CVE mailing list and tracked by multiple downstream vendors including Debian, SUSE, openSUSE, Amazon Linux, and the Yocto Project, all of which issued security advisories or package updates. Tenable published multiple Nessus detection plugins (304175, 311335, 311340, 318102, 318240, 319659) and Qualys added detection as well. Community discussion was limited, with automated CVE tracking accounts on Bluesky noting the disclosure (Feedly, Debian Tracker).