CVE-2026-23458: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23458 is a use-after-free vulnerability in the Linux kernel's netfilter ctnetlink subsystem, specifically in the ctnetlink_dump_exp_ct() function. The function stores a conntrack pointer in the netlink dump callback but releases the reference immediately after netlink_dump_start(), causing a dangling pointer when multi-round dumps are performed. Affected kernel versions span from 3.10 through multiple stable branches up to 6.19.x (before 6.19.10), 6.13.x (before 6.18.20), 6.7.x (before 6.12.78), 6.2.x (before 6.6.130), 5.16.x (before 6.1.167), 5.11.x (before 5.15.203), and 3.10.x (before 5.10.253), as well as Linux kernel 7.0-rc1 through rc4. It carries a CVSS v3.1 base score of 7.8 (High) (GitHub Advisory).

The root cause is classified as CWE-416 (Use After Free). In ctnetlink_dump_exp_ct(), a conntrack reference is stored in cb->data for use by the dump callback ctnetlink_exp_ct_dump_table(), but the reference is dropped immediately after netlink_dump_start(). When a netlink dump spans multiple rounds (i.e., the response is too large for a single message), the second recvmsg() call triggers the dump callback, which dereferences the now-freed conntrack structure via nfct_help(ct), resulting in a use-after-free on ct->ext. The missing .start and .done callbacks in the netlink_dump_control structure — which other functions in the same file correctly implement — are the direct cause of the improper reference lifecycle management. Exploitation requires local access with CAP_NET_ADMIN capability and the ability to perform netlink socket operations (GitHub Advisory).

A local attacker with CAP_NET_ADMIN capability can trigger this vulnerability through crafted netlink socket operations to read or write freed kernel memory, potentially enabling arbitrary code execution within the kernel context. Successful exploitation could result in full confidentiality, integrity, and availability compromise of the affected system, including privilege escalation to root, kernel crash (denial of service), or lateral movement within a containerized environment where CAP_NET_ADMIN is granted (GitHub Advisory).

1. Gain local access with CAP_NET_ADMIN: Obtain a local shell with CAP_NET_ADMIN capability — either as root, via a misconfigured container, or through privilege escalation.
2. Create a conntrack entry: Use netlink (NFNETLINK) to create a conntrack entry via ctnetlink_new_conntrack, establishing the conntrack object in kernel memory.
3. Initiate a multi-round netlink dump: Send a NFNL_MSG_CTEXP_GET_CT netlink request that triggers ctnetlink_dump_exp_ct(), which stores the conntrack pointer in cb->data and immediately drops the reference.
4. Trigger the use-after-free: Issue a second recvmsg() call to continue the dump. The kernel invokes ctnetlink_exp_ct_dump_table(), which dereferences the freed conntrack via nfct_help(ct), accessing ct->ext in freed memory.
5. Achieve kernel memory read/write: Depending on heap layout and timing, the freed memory may have been reallocated, allowing the attacker to read sensitive kernel data or corrupt kernel structures to escalate privileges (GitHub Advisory).

• Logs: Kernel KASAN reports containing BUG: KASAN: slab-use-after-free in ctnetlink_exp_ct_dump_table in dmesg or /var/log/kern.log.
• Process: Unusual processes performing repeated recvmsg() calls on netlink sockets related to NFNETLINK; processes named similarly to ctnetlink_poc appearing in process listings.
• Kernel: Kernel oops or panic traces referencing ctnetlink_exp_ct_dump_table, netlink_dump, or netlink_recvmsg in crash dumps or dmesg output.
• Network: Unexpected or high-frequency netlink socket activity from non-administrative processes, particularly involving NFNETLINK family sockets.

Apply the latest stable kernel patches for your running kernel version. Fixed versions include: 5.10.253, 5.15.203, 6.1.167, 6.6.130, 6.12.78, 6.18.20, and 6.19.10. The fix adds .start and .done callbacks to the netlink_dump_control structure to properly manage conntrack reference counting across multi-round dump operations. As a workaround where patching is not immediately possible, restrict CAP_NET_ADMIN access to trusted users and processes only, and limit unprivileged user namespaces if not required (sysctl kernel.unprivileged_userns_clone=0 on applicable systems). Vendor patches are available from upstream kernel stable trees and downstream distributions including SUSE, Debian, Amazon Linux, and openSUSE (GitHub Advisory, kernel patches).