CVE-2026-23351 - Vulnerability Details

- netfilter: nft_set_pipapo: split gc into unlink and reclaim phase

Description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nft_set_pipapo: split gc into unlink and reclaim phase

Yiming Qian reports Use-after-free in the pipapo set type:
Under a large number of expired elements, commit-time GC can run for a very
long time in a non-preemptible context, triggering soft lockup warnings and
RCU stall reports (local denial of service).

We must split GC in an unlink and a reclaim phase.

We cannot queue elements for freeing until pointers have been swapped.
Expired elements are still exposed to both the packet path and userspace
dumpers via the live copy of the data structure.

call_rcu() does not protect us: dump operations or element lookups starting
after call_rcu has fired can still observe the free'd element, unless the
commit phase has made enough progress to swap the clone and live pointers
before any new reader has picked up the old version.

This a similar approach as done recently for the rbtree backend in commit
35f83a75529a ("netfilter: nft_set_rbtree: don't gc elements on insert").

Published: 2026-03-25

Score: 7.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The Linux kernel’s nft_set_pipapo set type contains a use‑after‑free bug identified as CWE‑825. When many elements expire, the garbage‑collection routine can run for an extended period while the kernel is in a non‑preemptible context, allowing the freed memory to be accessed afterward. This condition triggers soft lockup warnings and RCU stall reports, effectively hanging the system and denying local functionality.

Affected Systems

The flaw resides in the core Linux kernel and affects all Linux distributions that ship an unpatched kernel. No specific kernel version range is listed, so users must check whether their current kernel includes the highlighted patch, typically available in recent releases from the mainline kernel series.

Risk and Exploitability

The CVSS score of 7.8 signals a high severity, yet the EPSS score is below 1 % and the vulnerability is not in the CISA KEV catalog, indicating a low current exploitation likelihood. Exploitation requires local or privileged access to manipulate the pipapo set type and force many entries to expire. The attack vector is inferred to be local, needing kernel‑level privileges; an attacker would trigger the long GC run to cause service denial.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`3c4287f62044a90e73a561aa05fc46e62da173da`	affected	< 65ca51b9fb85477ab92a04295aed34b38f7c062e
`3c4287f62044a90e73a561aa05fc46e62da173da`	affected	< c0f1f85097ac2b6e7d750fe4d05807985cd3fd3a
`3c4287f62044a90e73a561aa05fc46e62da173da`	affected	< 16f3595c0441d87dfa005c47d8f95be213afaa9e
`3c4287f62044a90e73a561aa05fc46e62da173da`	affected	< 7864c667aed01a58b87ca518a631322cd0ac34c0
`3c4287f62044a90e73a561aa05fc46e62da173da`	affected	< c12d570d71920903a1a0468b7d13b085203d0c93
`3c4287f62044a90e73a561aa05fc46e62da173da`	affected	< 500a50a301ce962b019ab95053ac70264fec2c21
`3c4287f62044a90e73a561aa05fc46e62da173da`	affected	< aff13667708dfa0dce136b8efd81baa9fa6ef261
`3c4287f62044a90e73a561aa05fc46e62da173da`	affected	< 9df95785d3d8302f7c066050117b04cd3c2048c2

Linux

affected

Version	Status	Constraints
`5.6`	affected	—
`0`	unaffected	< 5.6
`5.10.253`	unaffected	≤ 5.10.*
`5.15.203`	unaffected	≤ 5.15.*
`6.1.167`	unaffected	≤ 6.1.*
`6.6.130`	unaffected	≤ 6.6.*
`6.12.77`	unaffected	≤ 6.12.*
`6.18.17`	unaffected	≤ 6.18.*
`6.19.7`	unaffected	≤ 6.19.*
`7.0`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[3c4287f62044a90e73a561aa05fc46e62da173da,16f3595c0441d87dfa005c47d8f95be213afaa9e)`	affected	code_commit	—
`[3c4287f62044a90e73a561aa05fc46e62da173da,7864c667aed01a58b87ca518a631322cd0ac34c0)`	affected	code_commit	—
`[3c4287f62044a90e73a561aa05fc46e62da173da,c12d570d71920903a1a0468b7d13b085203d0c93)`	affected	code_commit	—
`[3c4287f62044a90e73a561aa05fc46e62da173da,500a50a301ce962b019ab95053ac70264fec2c21)`	affected	code_commit	—
`[3c4287f62044a90e73a561aa05fc46e62da173da,aff13667708dfa0dce136b8efd81baa9fa6ef261)`	affected	code_commit	—
`[3c4287f62044a90e73a561aa05fc46e62da173da,9df95785d3d8302f7c066050117b04cd3c2048c2)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.6`	affected	generic	—
`[0,5.6)`	unaffected	generic	—
`[6.1.167,6.2.0)`	unaffected	semver	—
`[6.6.130,6.7.0)`	unaffected	semver	—
`[6.12.77,6.13.0)`	unaffected	semver	—
`[6.18.17,6.19.0)`	unaffected	semver	—
`[6.19.7,6.20.0)`	unaffected	semver	—
`[7.0-rc3,*]`	unaffected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply a kernel update that includes the CVE‑2026‑23351 fix.
Verify that your kernel has the patch by running `uname -a` and comparing with the distribution’s security advisory.
If a patch is not yet available, monitor kernel logs for soft lockup or RCU stall warnings and consider temporarily disabling or limiting use of the pipapo set type until a fix is released.

Generated by OpenCVE AI on April 2, 2026 at 17:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00013.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/16f3595c0441d87dfa005c47d8f95be213afaa9e
https://git.kernel.org/stable/c/500a50a301ce962b019ab95053ac70264fec2c21
https://git.kernel.org/stable/c/65ca51b9fb85477ab92a04295aed34b38f7c062e
https://git.kernel.org/stable/c/7864c667aed01a58b87ca518a631322cd0ac34c0
https://git.kernel.org/stable/c/9df95785d3d8302f7c066050117b04cd3c2048c2
https://git.kernel.org/stable/c/aff13667708dfa0dce136b8efd81baa9fa6ef261
https://git.kernel.org/stable/c/c0f1f85097ac2b6e7d750fe4d05807985cd3fd3a
https://git.kernel.org/stable/c/c12d570d71920903a1a0468b7d13b085203d0c93
https://lore.kernel.org/linux-cve-announce/2026032536-CVE-2026-23351-637f@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-23351
https://www.cve.org/CVERecord?id=CVE-2026-23351

History

Sat, 18 Apr 2026 09:15:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/65ca51b9fb85477ab92a04295aed34b38f7c062e https://git.kernel.org/stable/c/c0f1f85097ac2b6e7d750fe4d05807985cd3fd3a

Thu, 02 Apr 2026 15:15:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}`	cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Thu, 26 Mar 2026 12:30:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-416

Thu, 26 Mar 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://lore.kernel.org/linux-cve-announce/2026032536-CVE-2026-23351-637f@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-23351 https://www.cve.org/CVERecord?id=CVE-2026-23351
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Wed, 25 Mar 2026 22:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416

Wed, 25 Mar 2026 10:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_pipapo: split gc into unlink and reclaim phase Yiming Qian reports Use-after-free in the pipapo set type: Under a large number of expired elements, commit-time GC can run for a very long time in a non-preemptible context, triggering soft lockup warnings and RCU stall reports (local denial of service). We must split GC in an unlink and a reclaim phase. We cannot queue elements for freeing until pointers have been swapped. Expired elements are still exposed to both the packet path and userspace dumpers via the live copy of the data structure. call_rcu() does not protect us: dump operations or element lookups starting after call_rcu has fired can still observe the free'd element, unless the commit phase has made enough progress to swap the clone and live pointers before any new reader has picked up the old version. This a similar approach as done recently for the rbtree backend in commit 35f83a75529a ("netfilter: nft_set_rbtree: don't gc elements on insert").
Title		netfilter: nft_set_pipapo: split gc into unlink and reclaim phase
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/16f3595c0441d87dfa005c47d8f95be213afaa9e https://git.kernel.org/stable/c/500a50a301ce962b019ab95053ac70264fec2c21 https://git.kernel.org/stable/c/7864c667aed01a58b87ca518a631322cd0ac34c0 https://git.kernel.org/stable/c/9df95785d3d8302f7c066050117b04cd3c2048c2 https://git.kernel.org/stable/c/aff13667708dfa0dce136b8efd81baa9fa6ef261 https://git.kernel.org/stable/c/c12d570d71920903a1a0468b7d13b085203d0c93

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-03-25T10:27:36.854Z

Updated: 2026-04-18T08:58:05.366Z

Reserved: 2026-01-13T15:37:45.999Z

Link: CVE-2026-23351

Vulnrichment

No data.

NVD

Status : Awaiting Analysis

Published: 2026-03-25T11:16:33.450

Modified: 2026-04-18T09:16:20.350

Link: CVE-2026-23351

Redhat

Severity : Moderate

Publid Date: 2026-03-25T00:00:00Z

Links: CVE-2026-23351 - Bugzilla

OpenCVE Enrichment

Updated: 2026-04-02T20:23:04Z

Weaknesses

CWE-825

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object