CVE-2026-74565: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-74565 is a use-after-free vulnerability in the Linux kernel's netfilter nf_tables subsystem, caused by a globally shared nft_object rhltable that allows cross-network-namespace object access during teardown. The vulnerability was published on August 15, 2026, and affects Linux kernel versions from 5.1 up to (but not including) the fixed releases. Fixed versions include 6.12.103, 6.18.44, 7.1.8, and 7.2-rc6. No CVSS score has been formally assigned by NVD at this time; Feedly estimates the severity as Medium (GitHub Advisory, Feedly).

The root cause is a race condition (CWE-416: Use After Free) in net/netfilter/nf_tables_api.c and include/net/netfilter/nf_tables.h. The nft_object rhltable is maintained as a single global structure, meaning objects registered in one network namespace (netns) can be looked up and dereferenced by other netns instances. When nft_obj_destroy() frees an object immediately during table dismantling, concurrent lookups via nft_obj_lookup() — including through the nft_rcv_nl_event() path — can access the now-freed memory. The fix scopes the rhltable per-table rather than globally, and updates nft_obj_lookup() to accept a non-const table pointer to satisfy compiler requirements when passing objname_ht to rhltable_lookup() (GitHub Advisory, Feedly).

Successful exploitation allows a local user with CAP_NET_ADMIN capability in any network namespace to trigger a use-after-free condition, potentially enabling arbitrary kernel memory reads, kernel memory writes, or execution of arbitrary code with kernel privileges. This constitutes a local privilege escalation (elevation of privilege) that could lead to full system compromise. The vulnerability's scope is limited to systems where unprivileged users can create network namespaces or where CAP_NET_ADMIN is granted to untrusted users (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the disclosure date. The EPSS score is 0.0, reflecting very low current exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access and CAP_NET_ADMIN capability, which limits the attack surface compared to remotely exploitable vulnerabilities (GitHub Advisory, Feedly).

Apply the upstream kernel patches that make the nft_object rhltable per-table instead of global. Fixed versions are 6.12.103 (for the 6.12.x stable branch), 6.18.44 (for the 6.18.x branch), 7.1.8 (for the 7.1.x branch), and 7.2-rc6 or later. As a configuration-based mitigation, restrict CAP_NET_ADMIN to trusted users only and limit unprivileged user namespace creation (e.g., set kernel.unprivileged_userns_clone=0 on supported distributions) to reduce the attack surface until patching is possible (GitHub Advisory, Feedly).