CVE-2026-23385

A flaw was found in the Linux kernel's netfilter nf_tables component. A local or privileged user could trigger a failing memory allocation during a set flush operation. This vulnerability, related to how nf_tables handles set cloning, can lead to a kernel warning (WARN splat), potentially causing system instability or a denial of service.

This issue was discovered via syzkaller with fault injection, requiring artificial memory pressure conditions to trigger. The result is a WARN splat rather than a crash or exploitable condition. The nf_tables subsystem requires CAP_NET_ADMIN capabilities to manipulate firewall rules, limiting this to privileged users or containers with network admin capabilities.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.