CVE-2026-23272

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23272", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-01-13T15:37:45.991Z", "datePublished": "2026-03-20T08:08:52.946Z", "dateUpdated": "2026-10-30T12:23:53.783Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:23:53.783Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: unconditionally bump set->nelems before insertion\n\nIn case that the set is full, a new element gets published then removed\nwithout waiting for the RCU grace period, while RCU reader can be\nwalking over it already.\n\nTo address this issue, add the element transaction even if set is full,\nbut toggle the set_full flag to report -ENFILE so the abort path safely\nunwinds the set to its previous state.\n\nAs for element updates, decrement set->nelems to restore it.\n\nA simpler fix is to call synchronize_rcu() in the error path.\nHowever, with a large batch adding elements to already maxed-out set,\nthis could cause noticeable slowdown of such batches."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - nftables is accessed via nfnetlink sockets which require local system access (netlink socket). This is not remotely reachable.\nAC:L - The attacker controls the conditions: they fill the set to maximum, then insert another element to trigger the UAF. While the RCU reader race exists, the attacker controls both the insertion and can arrange for concurrent lookups, making the race reliably triggerable.\nPR:L - nfnetlink requires CAP_NET_ADMIN, but nftables is per-network-namespace and reachable via user namespaces (unshare -Urn), so an unprivileged local user can obtain CAP_NET_ADMIN in a new namespace.\nUI:N - No user interaction is needed. The attacker can trigger this entirely through their own netlink socket operations.\nS:U - The vulnerability operates within the kernel's security authority. There is no crossing of a security boundary like VM escape or sandbox escape.\nC:H - This is a use-after-free where an RCU reader accesses freed memory. The freed memory can be reclaimed and filled with attacker-controlled data via heap spraying, enabling arbitrary kernel memory reads.\nI:H - Use-after-free in the kernel enables heap spraying and type confusion, allowing arbitrary write primitives and control flow hijacking for code execution.\nA:H - The UAF can cause kernel crashes (oops/panic) when RCU readers access freed or corrupted memory. Even without full exploitation, the bug reliably causes availability impact."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/netfilter/nf_tables_api.c"], "versions": [{"version": "35d0ac9070ef619e3bf44324375878a1c540387b", "lessThan": "25841e8d4241c6c3763e70ae95050f8108707b46", "status": "affected", "versionType": "git"}, {"version": "35d0ac9070ef619e3bf44324375878a1c540387b", "lessThan": "022effa9c54903858e443b1225370e6c758d03f6", "status": "affected", "versionType": "git"}, {"version": "35d0ac9070ef619e3bf44324375878a1c540387b", "lessThan": "25fcaef7948912652905e96922f36583a84fffed", "status": "affected", "versionType": "git"}, {"version": "35d0ac9070ef619e3bf44324375878a1c540387b", "lessThan": "e3ccb11fc8249759d23326038c8db987ddaabc77", "status": "affected", "versionType": "git"}, {"version": "35d0ac9070ef619e3bf44324375878a1c540387b", "lessThan": "86bc4b1a0f672d47ac19f9022432cb6a2e01cb33", "status": "affected", "versionType": "git"}, {"version": "35d0ac9070ef619e3bf44324375878a1c540387b", "lessThan": "6826131c7674329335ca25df2550163eb8a1fd0c", "status": "affected", "versionType": "git"}, {"version": "35d0ac9070ef619e3bf44324375878a1c540387b", "lessThan": "ccb8c8f3c1127cf34d18c737309897c68046bf21", "status": "affected", "versionType": "git"}, {"version": "35d0ac9070ef619e3bf44324375878a1c540387b", "lessThan": "def602e498a4f951da95c95b1b8ce8ae68aa733a", "status": "affected", "versionType": "git"}, {"version": "fefdd79403e89b0c673965343b92e2e01e2713a8", "status": "affected", "versionType": "git"}, {"version": "4.9.33", "lessThan": "4.10", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/netfilter/nf_tables_api.c"], "versions": [{"version": "4.10", "status": "affected"}, {"version": "0", "lessThan": "4.10", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.273", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.224", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.177", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.141", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.91", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.17", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.7", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.10", "versionEndExcluding": "5.10.273"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.10", "versionEndExcluding": "5.15.224"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.10", "versionEndExcluding": "6.1.177"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.10", "versionEndExcluding": "6.6.141"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.10", "versionEndExcluding": "6.12.91"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.10", "versionEndExcluding": "6.18.17"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.10", "versionEndExcluding": "6.19.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.10", "versionEndExcluding": "7.0"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9.33"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/25841e8d4241c6c3763e70ae95050f8108707b46"}, {"url": "https://git.kernel.org/stable/c/022effa9c54903858e443b1225370e6c758d03f6"}, {"url": "https://git.kernel.org/stable/c/25fcaef7948912652905e96922f36583a84fffed"}, {"url": "https://git.kernel.org/stable/c/e3ccb11fc8249759d23326038c8db987ddaabc77"}, {"url": "https://git.kernel.org/stable/c/86bc4b1a0f672d47ac19f9022432cb6a2e01cb33"}, {"url": "https://git.kernel.org/stable/c/6826131c7674329335ca25df2550163eb8a1fd0c"}, {"url": "https://git.kernel.org/stable/c/ccb8c8f3c1127cf34d18c737309897c68046bf21"}, {"url": "https://git.kernel.org/stable/c/def602e498a4f951da95c95b1b8ce8ae68aa733a"}], "title": "netfilter: nf_tables: unconditionally bump set->nelems before insertion", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"x_adpType": "supplier", "providerMetadata": {"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-10-15T01:13:28.391Z"}, "affected": [{"vendor": "Siemens", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "versions": [{"status": "affected", "version": "0", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}], "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-23272", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T15:07:10.556223Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-416", "description": "CWE-416 Use After Free"}]}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-19T18:35:40.857Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"affected": [{"vendor": "Siemens", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "versions": [{"status": "affected", "version": "0", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}], "x_adpType": "supplier", "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}], "providerMetadata": {"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-10-15T01:13:28.391Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-23272", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T15:07:10.556223Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-416", "description": "CWE-416 Use After Free"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T15:07:11.254Z"}}], "cna": {"title": "netfilter: nf_tables: unconditionally bump set->nelems before insertion", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - nftables is accessed via nfnetlink sockets which require local system access (netlink socket). This is not remotely reachable.\nAC:L - The attacker controls the conditions: they fill the set to maximum, then insert another element to trigger the UAF. While the RCU reader race exists, the attacker controls both the insertion and can arrange for concurrent lookups, making the race reliably triggerable.\nPR:L - nfnetlink requires CAP_NET_ADMIN, but nftables is per-network-namespace and reachable via user namespaces (unshare -Urn), so an unprivileged local user can obtain CAP_NET_ADMIN in a new namespace.\nUI:N - No user interaction is needed. The attacker can trigger this entirely through their own netlink socket operations.\nS:U - The vulnerability operates within the kernel's security authority. There is no crossing of a security boundary like VM escape or sandbox escape.\nC:H - This is a use-after-free where an RCU reader accesses freed memory. The freed memory can be reclaimed and filled with attacker-controlled data via heap spraying, enabling arbitrary kernel memory reads.\nI:H - Use-after-free in the kernel enables heap spraying and type confusion, allowing arbitrary write primitives and control flow hijacking for code execution.\nA:H - The UAF can cause kernel crashes (oops/panic) when RCU readers access freed or corrupted memory. Even without full exploitation, the bug reliably causes availability impact."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "35d0ac9070ef619e3bf44324375878a1c540387b", "lessThan": "25841e8d4241c6c3763e70ae95050f8108707b46", "versionType": "git"}, {"status": "affected", "version": "35d0ac9070ef619e3bf44324375878a1c540387b", "lessThan": "022effa9c54903858e443b1225370e6c758d03f6", "versionType": "git"}, {"status": "affected", "version": "35d0ac9070ef619e3bf44324375878a1c540387b", "lessThan": "25fcaef7948912652905e96922f36583a84fffed", "versionType": "git"}, {"status": "affected", "version": "35d0ac9070ef619e3bf44324375878a1c540387b", "lessThan": "e3ccb11fc8249759d23326038c8db987ddaabc77", "versionType": "git"}, {"status": "affected", "version": "35d0ac9070ef619e3bf44324375878a1c540387b", "lessThan": "86bc4b1a0f672d47ac19f9022432cb6a2e01cb33", "versionType": "git"}, {"status": "affected", "version": "35d0ac9070ef619e3bf44324375878a1c540387b", "lessThan": "6826131c7674329335ca25df2550163eb8a1fd0c", "versionType": "git"}, {"status": "affected", "version": "35d0ac9070ef619e3bf44324375878a1c540387b", "lessThan": "ccb8c8f3c1127cf34d18c737309897c68046bf21", "versionType": "git"}, {"status": "affected", "version": "35d0ac9070ef619e3bf44324375878a1c540387b", "lessThan": "def602e498a4f951da95c95b1b8ce8ae68aa733a", "versionType": "git"}, {"status": "affected", "version": "fefdd79403e89b0c673965343b92e2e01e2713a8", "versionType": "git"}, {"status": "affected", "version": "4.9.33", "lessThan": "4.10", "versionType": "semver"}], "programFiles": ["net/netfilter/nf_tables_api.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "4.10"}, {"status": "unaffected", "version": "0", "lessThan": "4.10", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.273", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.224", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.177", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.141", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.91", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.17", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "6.19.7", "versionType": "semver", "lessThanOrEqual": "6.19.*"}, {"status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/netfilter/nf_tables_api.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/25841e8d4241c6c3763e70ae95050f8108707b46"}, {"url": "https://git.kernel.org/stable/c/022effa9c54903858e443b1225370e6c758d03f6"}, {"url": "https://git.kernel.org/stable/c/25fcaef7948912652905e96922f36583a84fffed"}, {"url": "https://git.kernel.org/stable/c/e3ccb11fc8249759d23326038c8db987ddaabc77"}, {"url": "https://git.kernel.org/stable/c/86bc4b1a0f672d47ac19f9022432cb6a2e01cb33"}, {"url": "https://git.kernel.org/stable/c/6826131c7674329335ca25df2550163eb8a1fd0c"}, {"url": "https://git.kernel.org/stable/c/ccb8c8f3c1127cf34d18c737309897c68046bf21"}, {"url": "https://git.kernel.org/stable/c/def602e498a4f951da95c95b1b8ce8ae68aa733a"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: unconditionally bump set->nelems before insertion\n\nIn case that the set is full, a new element gets published then removed\nwithout waiting for the RCU grace period, while RCU reader can be\nwalking over it already.\n\nTo address this issue, add the element transaction even if set is full,\nbut toggle the set_full flag to report -ENFILE so the abort path safely\nunwinds the set to its previous state.\n\nAs for element updates, decrement set->nelems to restore it.\n\nA simpler fix is to call synchronize_rcu() in the error path.\nHowever, with a large batch adding elements to already maxed-out set,\nthis could cause noticeable slowdown of such batches."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.273", "versionStartIncluding": "4.10"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.224", "versionStartIncluding": "4.10"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.177", "versionStartIncluding": "4.10"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.141", "versionStartIncluding": "4.10"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.91", "versionStartIncluding": "4.10"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.17", "versionStartIncluding": "4.10"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.19.7", "versionStartIncluding": "4.10"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.0", "versionStartIncluding": "4.10"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "4.9.33"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:23:53.783Z"}}}, "cveMetadata": {"cveId": "CVE-2026-23272", "state": "PUBLISHED", "dateUpdated": "2026-10-30T12:23:53.783Z", "dateReserved": "2026-01-13T15:37:45.991Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-03-20T08:08:52.946Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/netfilter/nf_tables_api.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "25841e8d4241c6c3763e70ae95050f8108707b46", "status": "affected", "version": "35d0ac9070ef619e3bf44324375878a1c540387b", "versionType": "git"}, {"lessThan": "022effa9c54903858e443b1225370e6c758d03f6", "status": "affected", "version": "35d0ac9070ef619e3bf44324375878a1c540387b", "versionType": "git"}, {"lessThan": "25fcaef7948912652905e96922f36583a84fffed", "status": "affected", "version": "35d0ac9070ef619e3bf44324375878a1c540387b", "versionType": "git"}, {"lessThan": "e3ccb11fc8249759d23326038c8db987ddaabc77", "status": "affected", "version": "35d0ac9070ef619e3bf44324375878a1c540387b", "versionType": "git"}, {"lessThan": "86bc4b1a0f672d47ac19f9022432cb6a2e01cb33", "status": "affected", "version": "35d0ac9070ef619e3bf44324375878a1c540387b", "versionType": "git"}, {"lessThan": "6826131c7674329335ca25df2550163eb8a1fd0c", "status": "affected", "version": "35d0ac9070ef619e3bf44324375878a1c540387b", "versionType": "git"}, {"lessThan": "ccb8c8f3c1127cf34d18c737309897c68046bf21", "status": "affected", "version": "35d0ac9070ef619e3bf44324375878a1c540387b", "versionType": "git"}, {"lessThan": "def602e498a4f951da95c95b1b8ce8ae68aa733a", "status": "affected", "version": "35d0ac9070ef619e3bf44324375878a1c540387b", "versionType": "git"}, {"status": "affected", "version": "fefdd79403e89b0c673965343b92e2e01e2713a8", "versionType": "git"}, {"lessThan": "4.10", "status": "affected", "version": "4.9.33", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/netfilter/nf_tables_api.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.10"}, {"lessThan": "4.10", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.273", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.224", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.177", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.141", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.91", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.17", "versionType": "semver"}, {"lessThanOrEqual": "6.19.*", "status": "unaffected", "version": "6.19.7", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"affectedData": [{"defaultStatus": "unknown", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "EEE0D9A1-4C7E-48E7-A9AF-94665FE9075B", "versionEndExcluding": "4.10", "versionStartIncluding": "4.9.33", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "EDFCFD07-2965-4650-8296-7B0C3DE7DCA3", "versionEndExcluding": "6.18.17", "versionStartIncluding": "4.10.1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "69245D10-0B71-485E-80C3-A64F077004D3", "versionEndExcluding": "6.19.7", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:4.10:-:*:*:*:*:*:*", "matchCriteriaId": "C201E405-86F2-4F96-984A-00A865219C86", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:4.10:rc6:*:*:*:*:*:*", "matchCriteriaId": "09B6110F-7933-484D-AEAF-5D15FF38647E", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:4.10:rc7:*:*:*:*:*:*", "matchCriteriaId": "75694C52-0ADF-45EC-80AC-D973535B5CB9", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:4.10:rc8:*:*:*:*:*:*", "matchCriteriaId": "29F29665-6B16-4D9F-A417-D0743395DF01", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: unconditionally bump set->nelems before insertion\n\nIn case that the set is full, a new element gets published then removed\nwithout waiting for the RCU grace period, while RCU reader can be\nwalking over it already.\n\nTo address this issue, add the element transaction even if set is full,\nbut toggle the set_full flag to report -ENFILE so the abort path safely\nunwinds the set to its previous state.\n\nAs for element updates, decrement set->nelems to restore it.\n\nA simpler fix is to call synchronize_rcu() in the error path.\nHowever, with a large batch adding elements to already maxed-out set,\nthis could cause noticeable slowdown of such batches."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nnetfilter: nf_tables: incrementar incondicionalmente set->nelems antes de la inserci\u00f3n\n\nEn caso de que el conjunto est\u00e9 lleno, se publica un nuevo elemento que luego se elimina sin esperar el per\u00edodo de gracia de RCU, mientras que un lector de RCU ya puede estar recorri\u00e9ndolo.\n\nPara abordar este problema, a\u00f1adir la transacci\u00f3n del elemento incluso si el conjunto est\u00e1 lleno, pero alternar la bandera set_full para informar -ENFILE de modo que la ruta de aborto deshaga de forma segura el conjunto a su estado anterior.\n\nEn cuanto a las actualizaciones de elementos, decrementar set->nelems para restaurarlo.\n\nUna soluci\u00f3n m\u00e1s simple es llamar a synchronize_rcu() en la ruta de error.\nSin embargo, con un gran lote a\u00f1adiendo elementos a un conjunto ya agotado, esto podr\u00eda causar una ralentizaci\u00f3n notable de dichos lotes."}], "id": "CVE-2026-23272", "lastModified": "2026-10-30T13:18:35.283", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-23272", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T15:07:10.556223Z", "version": "2.0.3"}}]}, "published": "2026-03-20T09:16:12.700", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/022effa9c54903858e443b1225370e6c758d03f6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/25841e8d4241c6c3763e70ae95050f8108707b46"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/25fcaef7948912652905e96922f36583a84fffed"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/6826131c7674329335ca25df2550163eb8a1fd0c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/86bc4b1a0f672d47ac19f9022432cb6a2e01cb33"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ccb8c8f3c1127cf34d18c737309897c68046bf21"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/def602e498a4f951da95c95b1b8ce8ae68aa733a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e3ccb11fc8249759d23326038c8db987ddaabc77"}, {"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-416"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "kernel: netfilter: nf_tables: unconditionally bump set->nelems before insertion", "id": "2449571", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449571"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-367", "details": ["A flaw was found in the Linux kernel's netfilter nf_tables component. A race condition occurs when elements are inserted into a full set, causing an element to be removed without proper synchronization with Read-Copy-Update (RCU) readers. This can allow a local attacker to trigger a use-after-free vulnerability, potentially leading to a denial of service or other unspecified impacts."], "name": "CVE-2026-23272", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-03-20T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-23272\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-23272\nhttps://lore.kernel.org/linux-cve-announce/2026032034-CVE-2026-23272-8ad1@gregkh/T"], "statement": "This vulnerability affects systems using nf_tables for packet filtering with sets that have size limits. When a set reaches capacity, the race between element insertion/removal and RCU readers creates a window for use-after-free. Exploitation requires the ability to configure nf_tables rules, which typically requires CAP_NET_ADMIN privileges or root access.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[35d0ac9070ef619e3bf44324375878a1c540387b,6826131c7674329335ca25df2550163eb8a1fd0c)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[35d0ac9070ef619e3bf44324375878a1c540387b,ccb8c8f3c1127cf34d18c737309897c68046bf21)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[35d0ac9070ef619e3bf44324375878a1c540387b,def602e498a4f951da95c95b1b8ce8ae68aa733a)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "fefdd79403e89b0c673965343b92e2e01e2713a8"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.10"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,4.10)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.18.17,6.18.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.19.7,6.19.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.0-rc3,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-03-20T10:36:46.865781+00:00", "updated": "2026-10-19T21:45:04.263373+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}