CVE-2026-23351

A flaw was found in the Linux kernel's netfilter component, specifically within the nft_set_pipapo module. A local attacker could exploit a use-after-free vulnerability when a large number of expired elements are present. This can cause the garbage collection (GC) process to run for an extended period in a non-preemptible context, leading to soft lockup warnings and RCU (Read-Copy-Update) stall reports, resulting in a local denial of service.

This flaw affects nftables firewall configurations using pipapo sets (e.g., for IP range matching). When many elements expire simultaneously, GC can cause soft lockups and RCU stalls. The UAF occurs because freed elements remain visible to packet path and dump operations during the clone/live pointer swap window.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.