CVE-2026-74565

A flaw was found in the Linux kernel's netfilter subsystem. The global nature of the nft_object rhltable allows a local attacker to access objects that are being deallocated by other network namespaces. This can lead to a use-after-free vulnerability, potentially resulting in memory corruption or denial of service.

A use-after-free risk exists in nf_tables object lookup because nft_object names were stored in a global rhltable shared across tables and network namespaces. An object being dismantled and immediately released in one netns could still be reached from a lookup path in another netns, creating a stale object access window. For the CVSS the PR:L is selected because reliable triggering requires local nftables netlink control or CAP_NET_ADMIN in a network namespace, but full host root may not be required when user namespaces or delegated network administration are available. The issue is not directly network reachable and is triggered through local control plane operations rather than packet traffic. Impact is at least a local denial of service via kernel crash and in worst case may allow confidentiality or integrity impact due to kernel use-after-free.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.