CVE-2026-46324

A flaw was found in the Linux kernel's netfilter component. A local attacker with CAP_NET_ADMIN capabilities could exploit a race condition during the unregistration of netlink hooks in the nf_tables subsystem. This could lead to a denial of service (DoS) through a kernel crash or hang. In some scenarios, this might also result in memory corruption, potentially leading to further impact on confidentiality and integrity.

nf_tables netdev and flowtable hook lists can be walked by concurrent netlink dumpers while control plane code unregisters and removes hooks. Some unregister paths used list_del instead of list_del_rcu, which is unsafe for RCU protected traversal and can expose a concurrent reader to inconsistent list pointers or a stale hook entry. The realistic impact is a local denial of service through kernel crash or hang during nftables hook removal and dump activity. For the CVSS the PR:L is used for the paranoid score because CAP_NET_ADMIN may be available to a less trusted local actor in a user namespace, container, or delegated network administration context. The issue is not directly network reachable and is triggered through nftables control plane operations rather than packet traffic.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.