CVE-2026-23458

A flaw was found in the Linux kernel's netfilter connection tracking (ctnetlink) component. This vulnerability, known as a use-after-free, occurs when the system attempts to access a memory location after it has been deallocated, which can lead to unpredictable behavior. A local attacker could exploit this by triggering a specific sequence of network communication operations (netlink dump callbacks) related to connection tracking. This could result in a denial of service, causing system instability or crashes.

The conntrack pointer was stored in dump callback state without holding a reference across multi-recvmsg dump rounds. Exploitation requires ability to use ctnetlink (typically CAP_NET_ADMIN). The fix uses .start/.done callbacks to pin the reference for the dump lifetime.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.